Questions tagged [dsa]

The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.

Filter by
Sorted by
Tagged with
3
votes
1answer
1k views

Why do digital signatures use a hash algorithm instead of a checksum?

Based on my knowledge, all digital signature algorithms use a hash function to sign a message, and then encrypt the hash result. So why do these algorithms not use a checksum instead of a hash ...
3
votes
2answers
2k views

Recovering private key from Secp256k1 signatures

I've seen many answers here and many articles that says we can recover the private key from reused R signatures. But, what if the r,s signatures are different in transaction of bitcoin then is there a ...
1
vote
0answers
38 views

Justification for the way s is computed in DSA? [duplicate]

I am sorry if this is a naive question but is there any justification for the way that s is computed in the DSA signature algorithm: $$ s = k^{-1} * (rx + m) $$ ...
0
votes
1answer
443 views

How trivial is it to derive a private key from two public keys?

It turns out that what I was attempting to do was create a form of ECDSA threshold signature protocol by just giving away multiple public keys and then having the two parties solve for the private. ...
6
votes
1answer
9k views

ECDSA Signature R|S to ASN1 DER Encoding question

I am trying to test my understanding on ECDSA Signature r|s to ASN.1 DER Encoding for NIST P-256. I have r|s and when I convert ...
1
vote
1answer
117 views

Requirements for attacker-controlled ECDSA identity point signature

Wikipedia's description of the ECDSA verification algorithm suggests verifiers should confirm that step 6 doesn't produce the identity point: Calculate the curve point ${(x_{1},y_{1})=u_{1}G + u_{...
1
vote
1answer
410 views

Will the ECDSA with SHA-3 implementation be quantum-proof?

I know, that ECDSA could be broken by quantum computers, but since there is post-quantum hash function SHA-3, does not this make the digital signature resistant to them?
2
votes
1answer
188 views

DSA signature computation

Reading through the DSA signature specification, one thing stood out for me. $r = (g^k \bmod{p} ) \bmod{q}$ Then $s$ is computed. In the computation above, why is the modulo $p$ required, given we ...
3
votes
1answer
721 views

Can Montgomery ladder multiplication be used with secp256k1?

While reading about Elliptical Curves and ECDSA, I found a paper ECDSA Security in Bitcoin and Ethereum: a Research Survey by Hartwig Mayer. On page 6, the authors say: The curve secp256k1 does not ...
1
vote
2answers
787 views

What kind of ECDSA signature encoding is this?

I am trying to generate an ECDSA signature using ARM's CryptoCell 310 (hardware cryptography module) and verify the signature using mbedTLS software library. The harware module documentation says ...
1
vote
1answer
77 views

Does the XML signature standard support Ed25519?

https://www.w3.org/2008/xmlsec/Drafts/xmldsig-core-20/#sec-ECKeyValue talks about ECDSA but even the explicit curve parameter stuff won't work with Ed25519 as Ed25519 has a completely different ...
1
vote
1answer
1k views

Is there any ECDSA Attack if I have millions of signatures?

I have been given the task to test the security of our company software. Our company software generates ecdsa signed supply order files. One can generate as many files as he wants. so my question is ...
1
vote
0answers
44 views

Is integrity important when building anonymity? [closed]

I was thinking about applying an anonymity process based on ECDSA signatures to anonymize blocks of information, not the public-key itself. Using a deterministic form of ECDSA to sign blocks and ...
3
votes
1answer
174 views

Does an adversary require the public key to perform operations when RSA or ECC is broken?

If we had a way to break signature or encryption schemes (e.g. recover the key, recover plaintexts from ciphertexts, forge signatures), e.g. a quantum computer that was powerful enough to break ...
0
votes
1answer
514 views

How to convert ECDSA P256 curve signature to SECP256K1 curve?

I would like to get the ATECC608A microchip to sign data with ECDSA secp256k1 curve, but the chip only signs using the P256 curve. Is there an operation I can do using the original message and the ...
2
votes
1answer
158 views

should one worry about timing attacks with signature verification?

To compare two varablies in such a way that timing attacks don't exist it's generally recommended you pad the strings to the same length and then look at each byte, even if an earlier byte was ...
1
vote
1answer
638 views

Does “hash than sign paradigm” apply to ECDSA cryptography?

From wikipedia https://en.wikipedia.org/wiki/Digital_signature#How_they_work and other articles I see that: "There are several reasons to sign such a hash (or message digest) instead of the whole ...
0
votes
1answer
378 views

Group signatures, security and ECDSA

I am reading up on group signatures. With RSA a public key can have more than one private key. For a public exponent $e$, private exponent $d$ and modulus $n$, there is more than one solution for the ...
3
votes
2answers
216 views

Elliptic Curve Digital Signature algorithm fails

I would like to monitor step by step running of ECDSA. Parameters I am working on: The elliptic curve satisfies the equation: $y^2 = x^3 + x + 1$. I picked up the base point $G$ as: $(0, 1)$ Finally,...
1
vote
2answers
717 views

ECDSA threshold signing

I searched "ECDSA threshold signing" recently and found a lot of papers where it is said that their authors solved the problem of ECDSA threshold signing efficiently: e.g. here and here. Why there ...
1
vote
1answer
353 views

Is using ECDSA with AES-GCM viable?

I'm pretty new to the whole cryptography scene, so please forgive me if I make any incorrect statements. I have a 16MB image that I'm encrypting and authenticating using AES-GCM. I obtain a 16MB ...
3
votes
1answer
648 views

Is it safe to use same private key in two or more EC signature algorithms?

Given two (or more) algorithms: ed25519 private key is random blob of 32 bytes public key is encoded point on Edwards 25519 curve. ECDSA with secp256k1 private key is random blob of 32 bytes ...
1
vote
1answer
379 views

Manual ECDSA signing

I'm trying to understand the step by step process of ECDSA signature. The function should be as follows: S = k^-1 (hash + dA * R) mod p, but I'm trying to ...
0
votes
1answer
269 views

ECDSA signing vs generating public key

I'm trying to understand the process of ECDSA signing. I already figured out the process of generating a public key out of a private key by multiplying the private key with G. The equation for ECDSA ...
3
votes
1answer
145 views

How to find q in a corrupted ECDSA signauture

I'm doing exam papers for a crypto exam and I've been given a corrupted ECDSA signature. I'm asked to check if the signature is valid (which I know how to do), however, the q value is corrupted and so ...
2
votes
1answer
173 views

Universal forgery based on mathematical problem

It is known that DSA admits universal forgery under assumption that the Attacker can solve the equation $x\equiv R^x\pmod p.$ Are there any other protocols admitting universal forgery based on non-...
-5
votes
1answer
175 views

Someone discover two pair privkey for one address

I have a question about bitcoin privkey: If you have TWO pair privkey(compressed and uncompressed) I wrote again TWO pair, yes i know, many person say - it is not possible, but... And this works ...
0
votes
1answer
645 views

How to compute negative point in EC-DSA?

Assuming we have a valid EC-DSA signature $\sigma = (r,s)$. We can then easily create another valid signature without the knowledge of the secret key by negating $s$. That is, $\sigma' = (r, -s)$ can ...
5
votes
1answer
832 views

Why are digital signatures used when performing DH?

Suppose the server has a public key which everyone knows is associated with it, maybe it's hardcoded into the browser or signed by some CA. At no point do you need the server to sign anything with it,...
0
votes
1answer
170 views

Need help solving a puzzle (from a layperson) [closed]

As the title says, I'm a layperson when it comes to cryptography, so my question may not make absolute sense. Apologies in advance if this is vague. Here is the puzzle I'm presented with: You were ...
0
votes
1answer
124 views

Calculating $s$ in ECDSA over $GF(2^m)$

I am implementing ECDSA over $GF(2^n)$. I am following RFC 6979 and compare my results with the example in Appendix A (which uses curve SECT163K1). My calculation of $r$ is correct, but I am ...
2
votes
0answers
423 views

Functional signatures with ECDSA Verifier

Functional signatures use some master key to create a functional signature key. The functional key can be used to sign messages, but only if the message is accepted by some predicate function. For ...
1
vote
1answer
259 views

Obtain Information about hash algorithm from ECDSA public key

I have an ECDSA Public Key in DER Format. I viewed the file in an ASN1 Editor and there's the OID 1.2.840.10045.1.1 whose superior (...
2
votes
1answer
61 views

Signing a message to make sure that it will not be tampered with when forwarded, without trusting the receivers?

Lets say there are 3 people. 1st signs a message and sends it to 2nd using public key encryption 1st deletes the message 1st tells 2nd to forward his message 2nd forwards the message to 3rd How can ...
2
votes
0answers
638 views

Is Diffie-Hellman key exchange for multiple parties used in practice?

After reading this question about the possibility of using DH key exchange for multiple parties I went looking for a (C) library able to do this and found none. (I find it hard to believe there is no ...
2
votes
1answer
537 views

What is customizable in ECDSA signature and verification?

Let's say I make a signing and verification ECDSA modules. Signing module receives plain message and outputs signed message. Verification module takes signed message and checks consistency. ...
1
vote
1answer
666 views

Can I use a random number generator with seed for key derivation?

I don't know a thing about cryptography so I'm judging by what I see in APIs docs. I want to use ECDSA or ECDH in my project. And what I know so far about key derivation in this systems is that they: ...
1
vote
1answer
388 views

Is it actually possible to secure data with gpg DSA keys?

I think GPG is difficult to understand . All the different versions and policies and algorythms . But today I got really confused . I tried to create a 3072 bit DSA key ( which as far as I undestand ...
-1
votes
1answer
121 views

Is it possible to generate random bits to be imported as a private key and then deducing his public key?

Is it possible to generate random bits (or any bits we decide) to be imported as a private key and then deducting his public key please? Ideally with a supported Javascript WebCrypto algorithm ( ...
2
votes
1answer
1k views

What are the fastest attacks on ECDLP?

Consider the ECDSA protocol, which is applied in different environments e.g. the Bitcoin system (for user addresses, and transaction signing). What are the greatest threats in terms of algorithms ...
5
votes
1answer
888 views

EdDSA (Ed25519) is any random number sufficient for a good private key?

Looking at a reference implementation it shows that the key pair generation simply does: read X bytes from RNG and then derive another value from these X bytes thus producing private key with derived ...
3
votes
1answer
1k views

Why is ECDSA secure?

I'm trying to understand why is this, in my opinion, counter intuitive construction secure. ECDSA is a tuple of two numbers (r, s) whose validity can be verified by public key. However I don't see the ...
0
votes
1answer
149 views

ECDSA: What is the purpose of adding a hash of the used certificate to the signed data?

I recently started looking into security mechanisms used for Car2Car communication according to DSRC/WAVE and ETSI. What I found so far is that each packet is signed using ECDSA mechanism. Also each ...
0
votes
2answers
498 views

DSA with composite p

One of the basic requirements of DSA is to choose some prime $p$ of certain bit length. The security then lies in the intractability of solving $y = g^x \pmod{p}$ for $x$. Is there any “easy” way to ...
2
votes
1answer
3k views

What is the difference between encrypting and signing in ECC asymmetric algorithm?

What is the difference between encrypting some data vs signing some data (using ECC)? Does it simply reverse the role of the public-private keys? In the past, I thought it was just a change of role ...
2
votes
2answers
618 views

What is the Discrete Logarithm Problem in (Z/Zp) in the DSA?

Literature on the DSA (e.g. Gupta 2014) agrees that the security in DSA relies on the difficulty to solve two distinct discrete logarithm problems (DLP): One is the DLP in prime-order ($q$) ...
4
votes
1answer
446 views

Are (EC) DSA blind signatures possible?

I've been searching for a way to create blind ECDSA signatures. My research and experimentation has led me to believe that this is not possible. I've been attempting to articulate why and I think ...
2
votes
1answer
1k views

What do GnuPG sign-only keys mean?

In GnuPG, there is the option of making keys which are "normal" (encrypt and sign) and sign-only keys . But what sense does that make in regards of DSA? Correct me if I am wrong, but I think DSA keys ...
8
votes
1answer
866 views

When to use safe prime or Schnorr group

Protocols that use $\mathbb{Z}_{p}^*$ arithmetic often choose $p$ to be a safe prime ($p = 2q + 1$, for prime $q$) or to have the Schnorr group form ($p = rq + 1$, for prime $q$). I understand that ...
7
votes
1answer
521 views

How can a non-crypto-expert implement crypto libraries in a programming language?

I'm a regular developer and thus not a crypto expert. I'd like to use ECDSA as a library in a programming language, Idris, which still doesn't have one. I could, obviously, try and port a particular ...

1 2
3
4 5
7