Questions tagged [dsa]

The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.

Filter by
Sorted by
Tagged with
1
vote
2answers
638 views

ECDSA threshold signing

I searched "ECDSA threshold signing" recently and found a lot of papers where it is said that their authors solved the problem of ECDSA threshold signing efficiently: e.g. here and here. Why there ...
1
vote
1answer
259 views

Is using ECDSA with AES-GCM viable?

I'm pretty new to the whole cryptography scene, so please forgive me if I make any incorrect statements. I have a 16MB image that I'm encrypting and authenticating using AES-GCM. I obtain a 16MB ...
3
votes
1answer
507 views

Is it safe to use same private key in two or more EC signature algorithms?

Given two (or more) algorithms: ed25519 private key is random blob of 32 bytes public key is encoded point on Edwards 25519 curve. ECDSA with secp256k1 private key is random blob of 32 bytes ...
1
vote
1answer
302 views

Manual ECDSA signing

I'm trying to understand the step by step process of ECDSA signature. The function should be as follows: S = k^-1 (hash + dA * R) mod p, but I'm trying to ...
0
votes
1answer
250 views

ECDSA signing vs generating public key

I'm trying to understand the process of ECDSA signing. I already figured out the process of generating a public key out of a private key by multiplying the private key with G. The equation for ECDSA ...
3
votes
1answer
126 views

How to find q in a corrupted ECDSA signauture

I'm doing exam papers for a crypto exam and I've been given a corrupted ECDSA signature. I'm asked to check if the signature is valid (which I know how to do), however, the q value is corrupted and so ...
2
votes
1answer
160 views

Universal forgery based on mathematical problem

It is known that DSA admits universal forgery under assumption that the Attacker can solve the equation $x\equiv R^x\pmod p.$ Are there any other protocols admitting universal forgery based on non-...
-5
votes
1answer
164 views

Someone discover two pair privkey for one address

I have a question about bitcoin privkey: If you have TWO pair privkey(compressed and uncompressed) I wrote again TWO pair, yes i know, many person say - it is not possible, but... And this works ...
0
votes
1answer
503 views

How to compute negative point in EC-DSA?

Assuming we have a valid EC-DSA signature $\sigma = (r,s)$. We can then easily create another valid signature without the knowledge of the secret key by negating $s$. That is, $\sigma' = (r, -s)$ can ...
5
votes
1answer
670 views

Why are digital signatures used when performing DH?

Suppose the server has a public key which everyone knows is associated with it, maybe it's hardcoded into the browser or signed by some CA. At no point do you need the server to sign anything with it,...
0
votes
1answer
163 views

Need help solving a puzzle (from a layperson) [closed]

As the title says, I'm a layperson when it comes to cryptography, so my question may not make absolute sense. Apologies in advance if this is vague. Here is the puzzle I'm presented with: You were ...
0
votes
1answer
114 views

Calculating $s$ in ECDSA over $GF(2^m)$

I am implementing ECDSA over $GF(2^n)$. I am following RFC 6979 and compare my results with the example in Appendix A (which uses curve SECT163K1). My calculation of $r$ is correct, but I am ...
2
votes
0answers
377 views

Functional signatures with ECDSA Verifier

Functional signatures use some master key to create a functional signature key. The functional key can be used to sign messages, but only if the message is accepted by some predicate function. For ...
1
vote
1answer
221 views

Obtain Information about hash algorithm from ECDSA public key

I have an ECDSA Public Key in DER Format. I viewed the file in an ASN1 Editor and there's the OID 1.2.840.10045.1.1 whose superior (...
2
votes
1answer
48 views

Signing a message to make sure that it will not be tampered with when forwarded, without trusting the receivers?

Lets say there are 3 people. 1st signs a message and sends it to 2nd using public key encryption 1st deletes the message 1st tells 2nd to forward his message 2nd forwards the message to 3rd How can ...
2
votes
0answers
476 views

Is Diffie-Hellman key exchange for multiple parties used in practice?

After reading this question about the possibility of using DH key exchange for multiple parties I went looking for a (C) library able to do this and found none. (I find it hard to believe there is no ...
1
vote
1answer
445 views

What is customizable in ECDSA signature and verification?

Let's say I make a signing and verification ECDSA modules. Signing module receives plain message and outputs signed message. Verification module takes signed message and checks consistency. ...
1
vote
1answer
424 views

Can I use a random number generator with seed for key derivation?

I don't know a thing about cryptography so I'm judging by what I see in APIs docs. I want to use ECDSA or ECDH in my project. And what I know so far about key derivation in this systems is that they: ...
1
vote
1answer
296 views

Is it actually possible to secure data with gpg DSA keys?

I think GPG is difficult to understand . All the different versions and policies and algorythms . But today I got really confused . I tried to create a 3072 bit DSA key ( which as far as I undestand ...
-1
votes
1answer
117 views

Is it possible to generate random bits to be imported as a private key and then deducing his public key?

Is it possible to generate random bits (or any bits we decide) to be imported as a private key and then deducting his public key please? Ideally with a supported Javascript WebCrypto algorithm ( ...
2
votes
1answer
773 views

What are the fastest attacks on ECDLP?

Consider the ECDSA protocol, which is applied in different environments e.g. the Bitcoin system (for user addresses, and transaction signing). What are the greatest threats in terms of algorithms ...
4
votes
1answer
756 views

EdDSA (Ed25519) is any random number sufficient for a good private key?

Looking at a reference implementation it shows that the key pair generation simply does: read X bytes from RNG and then derive another value from these X bytes thus producing private key with derived ...
3
votes
1answer
824 views

Why is ECDSA secure?

I'm trying to understand why is this, in my opinion, counter intuitive construction secure. ECDSA is a tuple of two numbers (r, s) whose validity can be verified by public key. However I don't see the ...
0
votes
1answer
133 views

ECDSA: What is the purpose of adding a hash of the used certificate to the signed data?

I recently started looking into security mechanisms used for Car2Car communication according to DSRC/WAVE and ETSI. What I found so far is that each packet is signed using ECDSA mechanism. Also each ...
0
votes
2answers
371 views

DSA with composite p

One of the basic requirements of DSA is to choose some prime $p$ of certain bit length. The security then lies in the intractability of solving $y = g^x \pmod{p}$ for $x$. Is there any “easy” way to ...
1
vote
1answer
2k views

What is the difference between encrypting and signing in ECC asymmetric algorithm?

What is the difference between encrypting some data vs signing some data (using ECC)? Does it simply reverse the role of the public-private keys? In the past, I thought it was just a change of role ...
2
votes
2answers
472 views

What is the Discrete Logarithm Problem in (Z/Zp) in the DSA?

Literature on the DSA (e.g. Gupta 2014) agrees that the security in DSA relies on the difficulty to solve two distinct discrete logarithm problems (DLP): One is the DLP in prime-order ($q$) ...
4
votes
1answer
356 views

Are (EC) DSA blind signatures possible?

I've been searching for a way to create blind ECDSA signatures. My research and experimentation has led me to believe that this is not possible. I've been attempting to articulate why and I think ...
2
votes
1answer
1k views

What do GnuPG sign-only keys mean?

In GnuPG, there is the option of making keys which are "normal" (encrypt and sign) and sign-only keys . But what sense does that make in regards of DSA? Correct me if I am wrong, but I think DSA keys ...
8
votes
1answer
759 views

When to use safe prime or Schnorr group

Protocols that use $\mathbb{Z}_{p}^*$ arithmetic often choose $p$ to be a safe prime ($p = 2q + 1$, for prime $q$) or to have the Schnorr group form ($p = rq + 1$, for prime $q$). I understand that ...
7
votes
1answer
483 views

How can a non-crypto-expert implement crypto libraries in a programming language?

I'm a regular developer and thus not a crypto expert. I'd like to use ECDSA as a library in a programming language, Idris, which still doesn't have one. I could, obviously, try and port a particular ...
1
vote
1answer
522 views

Downsides of not using deterministic ECDSA signatures for blockchain validation?

I've noticed that in many Bitcoin wallet implementations, as well as other blockchains, deterministic ECDSA signatures are being used (generally based on RFC 6979). There seems to be some benefits to ...
1
vote
2answers
2k views

What is the relation between x y and r s in an ECDSA signature?

I'm writing functions in C using OpenSSL and the EVP interface to interact with Intel SGX. One of those functions calculates an ECDSA (with SHA256) signature over some data. The output of the ECDSA ...
4
votes
1answer
455 views

How should ECDSA handle the null hash?

In ECDSA, assume your public key is $Q=(x,y)$, then when performing the verification of any message leading to a null hash value (that is $H(M)=0$), the signature $(r,s)=(x,x)$ would always lead to a ...
17
votes
2answers
1k views

Can deterministic ECDSA be protected against fault attacks?

In a paper by Barenghi and Pelosi, it was described that fault attacks could be used to derive the secret key when using deterministic ECDSA as described in RFC6979 by @Thomas_Pornin Deterministic (...
5
votes
1answer
6k views

Public-key format for ECDSA as in FIPS 186-4?

What is the public-key format for ECDSA as in FIPS 186-4, and where is it formally defined? In particular, are there variants beyond Cartesian coordinates? Is that a pair of bitstrings, or a ...
4
votes
1answer
1k views

Is it secure to ECDSA-sign a public key without hashing it first?

I am trying to sign an ECDH public key with ECDSA. However, my hardware does not allow me to implement a hash algorithm, considering I am running out of memory already. Therefore, I am currently just ...
2
votes
1answer
546 views

Why can ECDSA public keys be sent over an insecure network, while ECDSA is used to sign ECDH public keys to securely be transported over the network?

Basically the title says it all. I am trying to develop and understand an ECDH-ECDSA encryption. My current approach to provide some form of authentication to the ECDH is to use ECDSA to sign the ...
5
votes
2answers
348 views

Is DSA vulnerable if verifier doesn't check r' > 0?

If a DSA implementation neglects to check $r' > 0$ when verifying signatures, what are the consequences? Creating a forged $s$ would seem to require solving for $k$ $g^k mod\ p = nq$ which is ...
1
vote
1answer
414 views

Challenge Response at Application Layer of BLE using ECDSA

There is a need for an Offline BLE device to Auth a Phone. I am planning to use challenge response somewhat outlined here. There is a small change. Instead of shared secret. I am planning to use a ...
3
votes
1answer
164 views

Why do people worry about the exceptional procedure attack if it is not relevant to ECDSA?

The exception procedure attack is described here: https://www.iacr.org/archive/pkc2003/25670224/25670224.pdf People are afraid of this attack, because it could leak information on the private key in ...
3
votes
1answer
197 views

Can ECC correctness issues allow “remote attackers to spoof ECDSA signatures”?

CVE-2015-2730: Mozilla Network Security Services (NSS) before 3.19.1, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and other products, does not properly ...
7
votes
1answer
539 views

Goofs that could creep in ECDSA signature verification?

What are goofs that could creep in ECDSA signature verification, perhaps with focus on curves based on prime-order $\mathbb Z_p$, specifically P-256 aka secp256r1? Is it possible to construct test ...
0
votes
1answer
219 views

ECDSA Verification - Last Steps

Reaching the end of an ECDSA signature verification, we need to compute multiple point multiplication and addition as following: $R=(x_R, y_R) = u_1G + u_2Q$, where $u_1$ and $u_2$ are scalars, $G$ is ...
4
votes
1answer
1k views

ECDSA security using same per-message secrets $k$ but different signing keys

I know that when I have a ECDSA keypair and use it twice with the same $k$ to sign different messages then the private key can be recovered. If I now have multiple ECDSA keypairs and sign a message ...
2
votes
1answer
141 views

URN for ECDSA signature algorithms (including hash algorithm)

The URN form ECDSA signature algorithm is urn:nist-gov:ecdsa. But I am not able to find a named URN for algorithm SHA1withECDSA or SHA256withECDSA. Up to now I've ...
1
vote
1answer
4k views

Length of ECDSA signature

I am using "secp192k1" curve to generate the key for data signing using ECDSA scheme. Signature is generated using "SHA3-256withECDSA" algorithm provided by BouncyCastle. Theoretically, the length of ...
11
votes
1answer
692 views

(EC)DSA signature without hashing, or with offloaded hash?

In (EC)DSA as per FIPS 186-4, the message to sign is first hashed. Imagine that we skip this hashing stage, instead put the message where the hash was, and constrain the size of message $h$ to the ...
2
votes
1answer
342 views

Is there parameter recommendation of DSA or RSA?

I know there are recommendations of elliptic curve parameters (such as NIST P-xxx). Are there recommendations of DSA (or DLP such as Schnorr signature) or RSA parameters? If not, why?
2
votes
1answer
477 views

Cipher suite priority

I've been tasked with defining a list of cipher suites to use. The requirements for the cipher suites are the following: Symmetric Algorithm: AES-256 Key Exchange: ECDH P-384, DH 3072-bit, RSA ...