Questions tagged [dsa]

The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.

Filter by
Sorted by
Tagged with
49
votes
2answers
67k views

Signatures: RSA compared to ECDSA

I'm signing very small messages using RSA, and the signature and public key are added to every message, which requires a lot of space compared to the actual content. I'm considering switching to ...
35
votes
2answers
15k views

How does recovering the public key from an ECDSA signature work?

It is possible to recover the public key from an ECDSA signature values $(r,s)$? Please explain how this works.
27
votes
1answer
14k views

ECDSA Compressed public key point back to uncompressed public key point

From the ECDH demo here, if I generate a private key for Alice I can get _ P = 1175846487558108474218546536054752289210804601041 Which gives the following public ...
27
votes
1answer
18k views

How strong is the ECDSA algorithm?

Some cryptographic algorithms are as strong as the size of their key is, while other have some weaknesses that limit their strength (such as SHA-1). How strong is the ECDSA algorithm, and does that ...
26
votes
3answers
8k views

Can ECDSA signatures be safely made “deterministic”?

Using the terminology of the ECDSA Wikipedia page, ECDSA (and DSA) signatures require a random k value for each signature which ensures that the signature is different each time even if the message ...
24
votes
2answers
11k views

HMAC vs ECDSA for JWT

I will be implementing JSON web tokens into my website and have a question about implementing them. I have a choice of using two algorithms, HMAC-SHA256 and ECDSA-SHA256. I have used HMAC-SHA256 in ...
24
votes
1answer
11k views

ECDSA, EdDSA and ed25519 relationship / compatibility

I'm trying to understand the relationship between those three signature schemes (ECDSA, EdDSA and ed25519) and mainly, to what degree are they mutually compatible in the sense of key pair derivation, ...
22
votes
2answers
4k views

Using same keypair for Diffie-Hellman and signing

Are there any security risks using a single key-pair for both key-exchange and signing? I'm mainly interested in using Curve25519 for key-exchange and Ed25519 for signing. But similar combinations, ...
20
votes
1answer
807 views

How to provide secure “vanity” bitcoin address service?

Bitcoin addresses are RIPEMD-160 hashes of the public portion of a public/private ECDSA keypair (along with an abbreviated hash of the hash to provide a check code, as @pulpspy notes in a comment). ...
18
votes
3answers
3k views

Digital signature that is only verifiable by one specific person

I would like to digitally sign a message in such a way that the signature can only be verified by one specific person. Simply encrypting the signature will not work, because that person could then ...
18
votes
2answers
1k views

Can deterministic ECDSA be protected against fault attacks?

In a paper by Barenghi and Pelosi, it was described that fault attacks could be used to derive the secret key when using deterministic ECDSA as described in RFC6979 by @Thomas_Pornin Deterministic (...
17
votes
1answer
5k views

Reasons for Chinese SM2 Digital Signature Algorithm

In the IETF RFC draft named "SM2 Digital Signature Algorithm" a signature algorithm is specified. The RFC does however not mention why this signature algorithm has been defined. Nor does it specify ...
16
votes
2answers
909 views

What is the intuition for ECDSA?

I understand DH and ElGamal and RSA encryption/signatures. But when I look at ECDSA (or plain DSA), it seems like the formulas are just pulled out of thin air. I can verify that the algebra used in ...
16
votes
1answer
3k views

How does the “biased-$k$ attack” on (EC)DSA work?

I recently stumbled across Thomas Pornin's old answer about deterministic (EC)DSA again. There he states the following: Note that $k$ must be generated uniformly in the $[1, q-1]$ range (where $q$...
15
votes
2answers
20k views

What curve and key length to use in ECDSA?

I'm developing a client/server system in Java which is not interacting with third party software, so I don't have to worry about compatibility. At a certain point, I need the client and server to ...
15
votes
2answers
3k views

Can one reduce the size of ECDSA-like signatures?

Using $n$-bit ECDSA, a signature has a size of $2·n$. It is possible to recover the public key from this signature, which shows that there is a publicly visible redundancy in the signature. Is ...
14
votes
1answer
6k views

DSA vs. ElGamal vs. Schnorr

It has been well known for a long time that NSA played a primary role in the development of the Digital Signature Algorithm (DSA). DSA is a sort of hybrid of the ElGamal and Schnorr signature schemes....
14
votes
2answers
2k views

Is it safe to reuse a ECDSA nonce for two signatures if the public keys are different?

We denote the s value of an ECDSA signature $(r, s)$ on a message $m$ as: $s=\frac{H(m)+xr}{k}$ Assume two ECDSA signatures sharing the same nonce $(r, s_1) , (r, s_2)$ on two messages $m_1, m_2$, ...
12
votes
3answers
8k views

Creating a license system based on asymmetric encryption (RSA or ECDSA)

I’ve spent a couple of days researching the topic of creating a license system for my desktop software. While I fully understand that there’s no perfect copy protection, this approach seems to have ...
12
votes
1answer
826 views

Making ECDSA public keys one bit shorter

In compressed form, ECDSA public keys are one bit larger than the curve size. There are some situations where this extra bit is extremely inelegant. So I had the following idea as a way to remove it. ...
11
votes
3answers
16k views

Why can’t DSA be used for encryption?

This question at StackOverflow mentions that DSA cannot be used for encryption. But both RSA and DSA can be used to generate public and private keys, right? Then why can't I use the DSA public key to ...
11
votes
1answer
2k views

RFC 6979 - Why not simply hash the message & the private key for deterministic ECDSA?

Why go through the trouble of using the HMAC_DRBG process, instead of simply hashing [message | private key] to calculate $k$ for deterministic ECDSA? If the ...
11
votes
3answers
20k views

Using ECDSA keys for encryption

I know that ECDSA is used for signature only, but I wonder if I can use the public/private Elliptic Curve keys for encryption too. I have ECDSA SSH public keys and I wonder if I can use them to ...
11
votes
1answer
939 views

(EC)DSA signature without hashing, or with offloaded hash?

In (EC)DSA as per FIPS 186-4, the message to sign is first hashed. Imagine that we skip this hashing stage, instead put the message where the hash was, and constrain the size of message $h$ to the ...
10
votes
2answers
6k views

Are there any Secp256k1 ECDSA test examples available?

Are there any available test cases for testing elliptic curves like secp256k1 (Korblitz curves from http://www.secg.org/collateral/sec2_final.pdf)? For curves like P192 there are for example those ...
10
votes
1answer
2k views

What signature schemes allow recovering the public key from a signature?

It seems to be possible to retrieve the (public) key used for creating an ECDSA signature just from the signature alone. This seems like an interesting property; as far as I know, RSA doesn't share ...
10
votes
1answer
2k views

Why are MACs in general deterministic, whereas digital signature constructions are randomized?

The fact is I'm not quite sure if my question statement is true, however all the MAC constructions I know of (e.g. CBC-MAC, CMAC, HMAC) are deterministic, whereas many constructions for digital ...
9
votes
1answer
24k views

How can I convert a DER ECDSA signature to ASN.1?

I having trouble verifying an ECDSA signature signed using client side javascript with Java/BouncyCastle. The javascript signing function source: ...
9
votes
4answers
3k views

What is the signature scheme with the fastest batch verification protocol for multiple signers?

I'm looking for a scheme where signing may be costly (slow) but batch verification with different signers is the fastest possible. Modified ECDSA allows batch verification for different signers with ...
9
votes
1answer
522 views

Why use $(r,s)$ instead of $(r,s^{-1})$ as DSA signature?

A DSA signature consists of two scalars $(r,s)$. When signing $s$ is generated as: $s=k^{-1}(H(m)+xr) \mod q$ The signature is $(r,s)$ When verifying $s$ is only used to compute $w = s^{-1}$. So ...
9
votes
1answer
4k views

ECDSA vs RSA: Performance on Android platform and surprising results

For our privacy-preserving protocol, an encrypted channel is established. In order to protect our system from man-in-the-middle attacks, signature-based approach is used. After we've implemented it ...
9
votes
1answer
2k views

Performance of ECDSA, ECKCDSA and ECGDSA

It is proven that ECDSA algorithms are faster in key and signature generation compared to RSA. In addition, the signatures are much shorter. However, I would like to know the performance difference ...
9
votes
1answer
2k views

Simple digital signature example that one could compute without a computer?

I am working on a document to explain Bitcoin to students. But I am having a hard time translating the principle described in §2 of the Bitcoin whitepaper in layman's terms. There is a great question ...
8
votes
2answers
343 views

What is TPMFail attack and what are the countermeasures?

Trusted Platform Module (TPM) is designed as a hardware-based root of trust to protect cryptographic keys even against system based adversaries. Although Intel's firmware based fTPM has FIPS 140-2 ...
8
votes
1answer
4k views

What is the difference between ECDSA and EdDSA

As I understand it, both work with elliptic curves but there seems to be a difference as EdDSA is generally recommended over ECDSA.
8
votes
2answers
1k views

How is the x coordinate of a “point at infinity” encoded in a Secp256k1 signature?

I'm testing an implementation of Bitcoin, which uses the curve Secp256k1 for ECDSA, and I want to see how it handles the point at infinity ($0$) if present in a signature. For example, r could be the ...
8
votes
1answer
348 views

Are DSA and ECDSA provably secure assuming DL security?

Is there proof that the DSA construction, also used by ECDSA, is secure assuming that discrete logarithms in the relevant group representation are difficult?
8
votes
2answers
961 views

Given a message and signature, find a public key that makes the signature valid (ECDSA)

This question is a variant on Given a message and signature, find a public key that makes the signature valid, which discusses the analogous question for RSA. It was suggested to me by this post over ...
8
votes
1answer
908 views

When to use safe prime or Schnorr group

Protocols that use $\mathbb{Z}_{p}^*$ arithmetic often choose $p$ to be a safe prime ($p = 2q + 1$, for prime $q$) or to have the Schnorr group form ($p = rq + 1$, for prime $q$). I understand that ...
8
votes
1answer
800 views

How can ECDSA signatures be shortened (to be used as a product key)?

So I made my own serial key generation software, using ECDSA, for use in my own applications and it works great so far! To keep the serial key short enough I use a 128 bit EC curve. My final signature ...
8
votes
0answers
124 views

Software timing attack using Kocher method

What's the minimum number of random sample points needed in Kocher's timing attack, so that we can determine enough valid measurements of $A_{i,r}$ and $D_{i,r}$? I'm working from this paper: Volker ...
7
votes
2answers
296 views

Why ECDSA has its form?

According to Wikipedia, if Alice wants to sign some message, she computes $s = k^{-1} (z + r d_A)$ then sends $(r, s)$ to Bob. I don't understand why they use this particular formula $s = k^{-1} (z + ...
7
votes
1answer
2k views

Curve25519 over Ed25519 for key exchange? Why?

I've been reading up on the Signal Protocol (in this PDF) and it seems to be using Curve25519 for ECDH and EdDSA (with Ed25519) for signatures. My question is why not use only Ed25519? This ...
7
votes
1answer
15k views

ECC key size and signature size

My understanding of ECDSA signature length is that it depends on the key size. So for instance, if a "prime256v1" is used, the signature length will be 64 because (n/8)*2 and for "secp384r1" it will ...
7
votes
1answer
541 views

How can a non-crypto-expert implement crypto libraries in a programming language?

I'm a regular developer and thus not a crypto expert. I'd like to use ECDSA as a library in a programming language, Idris, which still doesn't have one. I could, obviously, try and port a particular ...
7
votes
1answer
543 views

preferred method for generating k for DSA / ECDSA

FIPS 186-4, sections B.2.1 and B.2.2, discuss two different methods for generating k for DSA / ECDSA. Unless I'm mistaken RFC 6979 discusses another method utilizing HMAC_DRBG. So what method is the ...
7
votes
2answers
993 views

ECDSA signature verifiable 1-way transformations

Alice signs a message $m$ with her private key, yielding a signature ($r$,$s$). I want to prove to someone else that I have this signature, but I don't want them to have the knowledge of what ($r$,$s$...
7
votes
1answer
515 views

Is it possible to decrypt an ECDSA private key if the same nonce is used across different private keys?

If the same nonce is used across different messages under the same private key, the private key can be easily revealed. However, let's consider another scenario. Two private keys, x1 and x2, are ...
7
votes
1answer
281 views

Are there security issues with discrete logarithm keys not being uniformly distributed?

Generally, algorithms based on discrete logarithm specify that private keys are chosen as scalars between 1 and the order of the group (denoted $q$ here). For instance IEEE P1363 and FIPS 186-3 both ...
7
votes
1answer
626 views

Goofs that could creep in ECDSA signature verification?

What are goofs that could creep in ECDSA signature verification, perhaps with focus on curves based on prime-order $\mathbb Z_p$, specifically P-256 aka secp256r1? Is it possible to construct test ...

1
2 3 4 5
8