Questions tagged [dsa]

The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.

Filter by
Sorted by
Tagged with
22
votes
2answers
10k views

HMAC vs ECDSA for JWT

I will be implementing JSON web tokens into my website and have a question about implementing them. I have a choice of using two algorithms, HMAC-SHA256 and ECDSA-SHA256. I have used HMAC-SHA256 in ...
2
votes
1answer
2k views

RSA vs ECDSA/ECDH

So we've been using RSA for a while now. I wonder, is it still secure? I'm wondering whether surveillance agencies can at this point read traffic encrypted with say, TLS_ECDH_RSA_WITH_AES_128_GCM? ...
2
votes
1answer
142 views

Is there a single-use signature scheme, where a second use of the private key discloses it to the world?

With ECDSA (and possibly DSA too) I'm aware that if the same value for $k$ is used with the same private key $D_A$ to sign two different messages, then anyone possessing the two messages $m_0$ and $...
0
votes
1answer
317 views

Is there a library-less implementation of DSA available to read? [closed]

Is there a pedagogical library-less implementation of DSA available to read? (Not ECDSA.) Obviously BigInteger and hash functions may be from libraries, but I want to read the implementation of all ...
1
vote
1answer
265 views

With ECDSA is there a way for the verifier to calculate any properties of $k$?

With ECDSA, given $(r,s)$ and $m$, is there a way for a verifier to calculate any (boolean) properties of $k$, without knowing $k$ or the private key $D_A$? (I understand that $k$ should be random, ...
5
votes
3answers
1k views

Is it usual for a signed message to contain the public key of the signer?

In protocols/systems which use ECDSA, is it common for the message to contain the public key of the message signer? If not, how do recipients know that the message has been signed by the correct ...
3
votes
1answer
106 views

What is the correct name for bytes which are to be signed?

I have some bytes, and I sign them with my private key using ECDSA. The resultant (71) bytes are the signature. But what is the name of the bytes I have signed? (If this were encryption, they would ...
4
votes
1answer
3k views

Public Key Encryption using ECDHE and AES-GCM

Using a text book example, Alice and Bob want to communicate securely using encrypted messages over an insecure channel (the Internet). Alice and Bob have decided to use ECDH (using ephemeral keys ...
2
votes
2answers
183 views

What is the correct way to notate elliptic curve properties

When looking through elliptic curve and modulus posts i can see many examples of people referencing $p$ and $n$, in upper and lower case, and sometimes $Q$ is written instead of $p$ or $P$, and I ...
9
votes
1answer
2k views

Simple digital signature example that one could compute without a computer?

I am working on a document to explain Bitcoin to students. But I am having a hard time translating the principle described in §2 of the Bitcoin whitepaper in layman's terms. There is a great question ...
3
votes
1answer
517 views

How bad is it to use the identity function as hash for ECDSA?

I was recently asked whether a certain library supports the ECDSAwithNone Signature algorithm. Clearly this would mean ECDSA with the identity function as the hash function. I know this is a really ...
3
votes
1answer
566 views

Do ECDH and ECDSA combined solution provide an authenticated protocol exchange solution in MCU environment?

I'm working on a project in MCU (micro controller) environment with GPRS connection to exchange data securely with the cloud. The encryption algorithm has been selected to use AES. I did some search ...
4
votes
1answer
621 views

Why a key pair is used in OpenSSL ECDSA_sign or ECDSA_do_sign instead of only private key ?

If the digital signature in ECC (ECDSA) is made using a private key, why is the OpenSSL library using ECKEY pair as an input parameter instead of the private key only ?
3
votes
1answer
3k views

What are the differences between curve NIST P-521 and Edwards E-521 for signature?

I implemented and used the P-521 curve for ECDSA. Signatures are 132 bytes long. It seems that Edwards E-521 is safer but I did not investigated very deeper. What is its signature length ? How is it ...
2
votes
3answers
204 views

Digital signature algorithms within the European Union

I've just noticed that US NIST has accepted DSA as a digital signature standard. Does the European Union have a similar standard, specifying an algorithm to use when digitally signing messages? I ...
2
votes
1answer
335 views

Why is there no 'ECDSA' version of 'DHE-RSA-CHACHA20-POLY1305'?

So I was just checking my TLS cipherlist and noticed that there was a 'DSS' / DSA / ECDSA version of every ...
5
votes
1answer
152 views

Why not to use curve over field of $p^m$ with $p > 2$ for ECDSA?

I'm reading the ECDSA paper and they say you can only use ECDSA with odd-power fields $p$ or with binary fields $2^m$. Why not other power prime fields?
5
votes
1answer
315 views

Can Alice send Bob a secure message with only DSA and no key exchange?

Suppose Bob has a DSA key pair, and Alice has Bob's public key. Is there any secure way that Alice can send Bob a message only he can read if Bob can not send any reply? I think the answer is no, ...
3
votes
2answers
540 views

Why we need ECDSA when we have ECDH?

ECDSA and ECDH give us the following methods: ...
2
votes
1answer
206 views

Is this a secure method of encrypting with authentication?

My goal is to allow two clients to send files securely over an untrusted network without the need for more than one block of information to be sent. Both clients have ECDSA keys of size 256 bits. I'd ...
1
vote
1answer
1k views

How can a lattice attack be applied to ECDSA signatures?

The aim is to check if it is possible to break the ECDSA cryptosystem under the following criteria. Suppose that each ECDSA signature is generated by using the GLV method for point multiplication (...
1
vote
0answers
295 views

verify fails on 3rd party after signing with BouncyCastle [closed]

I am using BouncyCastle to perform ECDH and then encrypt the data between the mobile (Android) and my hardware with ECIES. It all works fine. When I try to sign a byte array and send it to the ...
5
votes
1answer
199 views

Why do we truncate the hash when using DSA?

All the articles I read on the web about DSA keep telling me that the size of the hash needs to be truncated so that the bit length is equal to or lesser than the bit length of the prime number of the ...
2
votes
1answer
4k views

The difference in size between ECDSA output and hash size

So if I use secp256k1 for example, I've got my key size of 256 bit, and say I sign a SHA256 hash of a message, with size 256 bit, I get an output of size 512bit. Why is there a difference between the ...
2
votes
2answers
1k views

Elliptic curve brute forcing

I have elliptic curve of equation $y^2 \equiv x^3 -x $. And the coordinate of points $Q$ and $P$. I want to solve $Q=[k]P$ (where $k$ is the unknown) by testing all possible $k$. Is this the right ...
2
votes
1answer
168 views

Encoding a message to a point of curve y^2=x^3+7 and Bitcoin Core

Where should I look at in Bitcoin Core source code to figure out how the signature process transform a message in a curve point? To sign a transaction (message) in the Bitcoin system, you need to ...
5
votes
1answer
363 views

Adding two public keys

secp256k1 (the signature scheme used by Bitcoin) has the interesting property that you can add two public keys to get a combined key that requires both private keys to produce signatures for. Is ...
-1
votes
1answer
145 views

What does L_n is the bit length of the group order n states need for my calculation in ECDSA algorithm?

I am doing the program of implementing ECDSA for which I am trying to solve the equation scenario. In ECDSA that signature generation algorithm which states as hash value from the SHA-1 and where $l$ ...
7
votes
2answers
1k views

BER or DER X9.62 for ECDSA signature

The signature format for ECDSA signatures can be encoded using ASN.1 integers according to X9.62 or it can comprise of two integers with the same size as the key size. In case the X9.62 format is ...
1
vote
1answer
100 views

DSA: Authentication and assurance of authorized parties

When dealing with Asymmetric cryptographic algorithms, usually the sender of the critical data asks the listener for a Public Key for encrypting the data and sending them. This is while the private ...
8
votes
1answer
663 views

How can ECDSA signatures be shortened (to be used as a product key)?

So I made my own serial key generation software, using ECDSA, for use in my own applications and it works great so far! To keep the serial key short enough I use a 128 bit EC curve. My final signature ...
1
vote
1answer
2k views

ECDSA for encryption

ECDSA keys are much shorter than RSA keys, but typically only used for signing, not encryption. Is there an accepted way of doing this? (https://bitcointalk.org/index.php?topic=196378.0 ...
3
votes
1answer
659 views

Can the same random number be used in encryption and signing?

In several public key algorithms, the person running the algorithm must generate a random number (that's separate from the key). Can this random number be the same for an encryption and a signature? ...
1
vote
2answers
485 views

ECDSA Public key randomness

If I have a 256bit ECDSA public key how likely is it that the same public key will be generated by another person. Will it take on average 2^256 tries to generate same public key? If I xor the first ...
3
votes
1answer
116 views

Is changing $H(R\mathbin{\Vert}A\mathbin{\Vert}M)$ to $H(R\mathbin{\Vert}A\mathbin{\Vert}H(M))$ in EdDSA secure?

EdDSA calculates $s=(r+H(R\mathbin{\Vert}A\mathbin{\Vert}M)\cdot a)\bmod\ell$ and $r=H(h\mathbin{\Vert}M)$, with $H$ being the hash function (SHA2/512); $B$ being the generator; $A$ being the public ...
0
votes
1answer
362 views

Why are cryptographically secure hashes required for digital signing (RSA or DSA)?

I know that a cryptographically secure hashing algorithm is required for proper message signing (SHA-1, or I think SHA-2 is the current suggested algorithm). However, why does the hashing algorithm ...
2
votes
1answer
180 views

Are there signatures that don't have subliminal channels?

Are there signatures that don't have subliminal channels and also don't require commitments or zero-knowledge proofs? DSA or Schnorr signatures need a nonce which can leak valuable information. There ...
1
vote
1answer
468 views

request for data to test deterministic ecdsa signature algorithm for secp256k1

I’m implementing the RFC 6979 procedure to compute a message signature. I want to test my program on the secp256k1 elliptic curve. Note the “k” in secp256k1, i.e. the Koblitz curve. If you have the ...
10
votes
1answer
1k views

RFC 6979 - Why not simply hash the message & the private key for deterministic ECDSA?

Why go through the trouble of using the HMAC_DRBG process, instead of simply hashing [message | private key] to calculate $k$ for deterministic ECDSA? If the ...
3
votes
3answers
422 views

Verifying DER encoded DSA/ECDSA signature with extra content?

Having a DSA/ECDSA signature which is supposed to be DER encoded as an ASN.1 sequence of $r$ and $s$ (as described in the RFC), and being given some bytes which are ...
0
votes
1answer
1k views

Key generation in Digital Signature Algorithm

In DSA, one needs to generate two primes $p$ and $q$ such that $q$ is $256$-bit and $p$ is $3072$-bit and $p-1$ is a multiple of $q$. Question: How to generate such $p$ and $q$. Attempt: First, use ...
3
votes
1answer
4k views

Does the size of a ECDSA key determine the hash algorithm?

I am a bit lost in understanding what I read on authentication, signature, etc. For instance, is the size of the ECDSA keys produced by ssh-keygen -t ecdsa -b 256 ...
4
votes
1answer
3k views

Why is 224 bit ecdsa faster than 192 bit ecdsa?

I ran several benchmarks using openssl on 2 different computers and I got a surprising result. for the Nist 192 bit curve the benchmark result is ...
4
votes
1answer
200 views

Finding algorithm: desire RSA's uniqueness and ECDSA's space efficiency

I am asking for help in finding a signature algorithm with the following property: Given a message m and a private key prikey, ...
0
votes
1answer
160 views

How to calculate kinv from the given k value

I am implementing an ECDSA NIST test vectors verification application. The test vectors are taken from http://csrc.nist.gov/groups/STM/cavp/#09. One of the test vectors is given below: ...
4
votes
2answers
10k views

ECDSA with SHA256 and sepc192r1 curve: Impossible, or how to calculate $e$?

I need to use ECDSA as the signing algorithm and SHA256 for hashing the message. I'm running into troubles verifying the signature calculated on two different platform (one is BouncyCastle, another ...
2
votes
1answer
84 views

Validity of authentication scheme?

Here's an authentication scheme I had in mind that combines the simplicity of HTTP Digest Authentication and the security of real crypto primitives. I have in mind the user-level authentication, ie ...
3
votes
1answer
347 views

Attack on DSA modification with bad hash function

Given a (bad) modification of DSA where the hash function is the identity ($H(m)=m$), I am now supposed to design an attack. So $(m, (r,s))$ are given and I should be able to create a legit signature $...
33
votes
2answers
12k views

How does recovering the public key from an ECDSA signature work?

It is possible to recover the public key from an ECDSA signature values $(r,s)$? Please explain how this works.
14
votes
2answers
17k views

What curve and key length to use in ECDSA?

I'm developing a client/server system in Java which is not interacting with third party software, so I don't have to worry about compatibility. At a certain point, I need the client and server to ...