Questions tagged [dsa]

The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.

Filter by
Sorted by
Tagged with
3
votes
1answer
698 views

Can the same random number be used in encryption and signing?

In several public key algorithms, the person running the algorithm must generate a random number (that's separate from the key). Can this random number be the same for an encryption and a signature? ...
3
votes
1answer
4k views

Signature algorithm SHA 1-2 with ECDSA

Can someone please explain what key sizes are required for the ECDSA algorithm? I tried a 128 bit EC Key for SHA1withECDSA and it throws an error. However with 256 bit key I could run the algorithm. ...
3
votes
1answer
142 views

Likelihood of signature collision with EdDSA

Taking EdDSA as an example, given the length of a signature is 512-bits for a given data payload, what is the probability of a collision where there is another 512-bit value that is also a valid ...
3
votes
1answer
259 views

ECDSA signing process

I am trying to learn how ECDSA works. I do not have a background in maths, but have been following a guide which has built me up from finite fields, elliptic curves. I am unable to figure out how a ...
3
votes
1answer
158 views

Appending ECDSA signature to a message

I need to authenticate a message sent to an embedded device (which limits my options in terms of just using an existing convention). I can run ECDH/ECDSA on the device and can use SHA-256 as a hash ...
3
votes
1answer
174 views

Does an adversary require the public key to perform operations when RSA or ECC is broken?

If we had a way to break signature or encryption schemes (e.g. recover the key, recover plaintexts from ciphertexts, forge signatures), e.g. a quantum computer that was powerful enough to break ...
3
votes
1answer
226 views

Why do people worry about the exceptional procedure attack if it is not relevant to ECDSA?

The exception procedure attack is described here: https://www.iacr.org/archive/pkc2003/25670224/25670224.pdf People are afraid of this attack, because it could leak information on the private key in ...
3
votes
1answer
194 views

Comparison of security definitions for signatures

The two main security definitions for signatures are EUF-CMA and the strong version of it sEUF-CMA. What I see that their difference is that in EUF-CMA experiment, the adversary needs to produce a ...
3
votes
1answer
157 views

A method for creating distributed public key for ECDSA, what are the risk factors?

There is quite a bit of literature on distributed ECC signing without a trusted dealer. Published works are mostly overly complicated, so I am proposing this simple technique which I am sure if it is ...
3
votes
1answer
226 views

Why does FIPS 186-4 seem to have an excessively complex q generation?

So in DSA you have two primes - p and q. q is N bits long (let's assume 160 bits) and p is L bits long (let's assume 1024 bits). Here's what FIPS 186-4 says about generating the q parameter for DSA: ...
3
votes
1answer
638 views

Do ECDH and ECDSA combined solution provide an authenticated protocol exchange solution in MCU environment?

I'm working on a project in MCU (micro controller) environment with GPRS connection to exchange data securely with the cloud. The encryption algorithm has been selected to use AES. I did some search ...
3
votes
1answer
367 views

Attack on DSA modification with bad hash function

Given a (bad) modification of DSA where the hash function is the identity ($H(m)=m$), I am now supposed to design an attack. So $(m, (r,s))$ are given and I should be able to create a legit signature $...
3
votes
0answers
89 views

Why does ECDSA transmit s and not s^-1? [duplicate]

Given: $eG=P$, $kG=(r,y)$ ECDSA signature transmits (r,s) and does this calculation: $u = \frac{z}{s}$, $v = \frac{r}{s}$ $uG+vP=(r,y)$ means the signature is valid Why do we transmit $s$ and not ...
2
votes
1answer
669 views

Why is verification using DSA slower than verification with RSA?

We read in literature that verification of a digital signature is slower using DSA than if we used RSA. Why is this? DSA parameter generation: choose prime number $p$ choose prime number $q$ such ...
2
votes
3answers
558 views

Why are in asymmetric cryptography as many keys as people involved needed?

The question: "10 friends wish to establish secure communications between themselves using asymmetric-key cryptography. How many keys need to be known by each user?" was posed by my teacher. He says ...
2
votes
1answer
458 views

ECDSA where the group order is larger than the hash size?

According to wikipedia, when generating a signature for ECDSA, you do the following (among other things): Calculate $e=\operatorname{HASH}(m)$, where $\operatorname{HASH}$ is a cryptographic ...
2
votes
2answers
606 views

Could RSA keypairs be used for cryptocurrency addresses?

A bitcoin address is created from an ECDSA keypair. It is common to use use a hashed version of the public key as the shared address, but the original bitcoin implementation also allowed for using the ...
2
votes
1answer
174 views

Encoding a message to a point of curve y^2=x^3+7 and Bitcoin Core

Where should I look at in Bitcoin Core source code to figure out how the signature process transform a message in a curve point? To sign a transaction (message) in the Bitcoin system, you need to ...
2
votes
2answers
1k views

DSA, RSA, ECDSA etc - which one is cheapest for signing?

For a protocol where the server presents its signature to prove authenticity (e.g. IKE/SIGMA/STS with only one party authenticated), it's essential that the signing is extremely cheap, while ...
2
votes
1answer
167 views

What is the ChainOfFools/CurveBall Attack on ECDSA on Windows 10 CryptoAPI

What is the ChainOfFools/CurveBall Attack on ECDSA on Windows 10 CryptoAPI (Crypt32.dll) Could someone provide details?
2
votes
1answer
223 views

DSA: why using mod p mod q and not just mod p

I'd like to know, in DSA we compute several values modulo $p$ and modulo $q$, like $r = (g^k \bmod p) \bmod q$ or $v = (g^{u_1}h^{u_2} \bmod p) \bmod q$. As far as I understand, we want to use two ...
2
votes
1answer
602 views

What is the difference between: ecdsap, ecdsak, and ecdsab in the output of “openssl speed”? What do the letters P/K/B refer to?

openssl speed tests the speed of different protocols on your computer: ...
2
votes
1answer
147 views

Which one is better using DSA, or MAC and encryption?

I want to authenticate server messages to clients. The communication between clients and server is unicast. As I know I can use either used MAC or DSA. by using MAC, I required a shared key between ...
2
votes
1answer
2k views

RSA vs ECDSA/ECDH

So we've been using RSA for a while now. I wonder, is it still secure? I'm wondering whether surveillance agencies can at this point read traffic encrypted with say, TLS_ECDH_RSA_WITH_AES_128_GCM? ...
2
votes
1answer
1k views

What algorithm does PGP use to encrypt email?

I know it uses RSA/DSA to create keys, but does it use that same algorithm for the actual cipher?
2
votes
1answer
70 views

Is there any proof for ECDSA signature algorithm?

Related: Is there an interactive version of ECDSA signature protocol like the Schnorr identification protocol?
2
votes
1answer
71 views

Verify ECDSA signature without data

With RSA PKCS#1 v1.5 it is possible to verify that the signature was generated by the correct private key without actually having access to the data. You just perform the modular exponentiation with ...
2
votes
1answer
110 views

What would happen in DSA/ECDSA if there were a collision in $r$ but not $k$?

In DSA, the value of $r$ is generated as: $r = (g^k \bmod p) \bmod q$ ECDSA is similar, using the $x$ coordinate of the generator $g$ scalar-multiplied by $k$, again taken modulo $q$. It's well-...
2
votes
2answers
297 views

Max size for exponent and modulus in RSA and for y, p, q, g in DSS

I'm writing a method in Java to read SSH public key in RFC 4253 format, which, in my case, can be either RSA, or DSS. What I really need is to read exponent and <...
2
votes
1answer
548 views

Which hash function to be used with DSA 2048

I'm preparing for an examination of an Information Security course at university, but I'm not sure about an explanation I created for a specific exercise. The question is: There are now DSA ...
2
votes
1answer
571 views

What is customizable in ECDSA signature and verification?

Let's say I make a signing and verification ECDSA modules. Signing module receives plain message and outputs signed message. Verification module takes signed message and checks consistency. ...
2
votes
1answer
1k views

What are the fastest attacks on ECDLP?

Consider the ECDSA protocol, which is applied in different environments e.g. the Bitcoin system (for user addresses, and transaction signing). What are the greatest threats in terms of algorithms ...
2
votes
1answer
2k views

What do GnuPG sign-only keys mean?

In GnuPG, there is the option of making keys which are "normal" (encrypt and sign) and sign-only keys . But what sense does that make in regards of DSA? Correct me if I am wrong, but I think DSA keys ...
2
votes
1answer
697 views

Why can ECDSA public keys be sent over an insecure network, while ECDSA is used to sign ECDH public keys to securely be transported over the network?

Basically the title says it all. I am trying to develop and understand an ECDH-ECDSA encryption. My current approach to provide some form of authentication to the ECDH is to use ECDSA to sign the ...
2
votes
2answers
207 views

What is the correct way to notate elliptic curve properties

When looking through elliptic curve and modulus posts i can see many examples of people referencing $p$ and $n$, in upper and lower case, and sometimes $Q$ is written instead of $p$ or $P$, and I ...
2
votes
1answer
5k views

The difference in size between ECDSA output and hash size

So if I use secp256k1 for example, I've got my key size of 256 bit, and say I sign a SHA256 hash of a message, with size 256 bit, I get an output of size 512bit. Why is there a difference between the ...
2
votes
1answer
183 views

Are there signatures that don't have subliminal channels?

Are there signatures that don't have subliminal channels and also don't require commitments or zero-knowledge proofs? DSA or Schnorr signatures need a nonce which can leak valuable information. There ...
2
votes
1answer
403 views

Verifying multiplicative inverse on a prime field in NIST's ECDSA_Prime.pdf

I am trying to learn about the Elliptic Curve Digital Signature Algorithm (ECDSA) by verifying the results in some example calculations. I found a PDF of example ECDSA calculations from NIST here: ...
2
votes
1answer
454 views

Given p and q of DSA how do you show they are prime?

I am given p = 4916335901 q = 88903 and am asked to show these are prime as well as q|(p-1) in DSA. I am unsure on how to ...
2
votes
1answer
479 views

Can A PRNG Be Used To Generate Multiple Private Keys for ECDSA?

Suppose Alice seeds a cryptographically strong Pseudo Random Number Generator with a truly random number, and keeps it secret. Alice then uses the output of the PRNG to generate several 256-bit ...
2
votes
1answer
62 views

ECDSA Private Key from SSS

I have all of the Shamir's secret shares required to Lagrange-interpolate f(0), which represents an ECDSA private key. The field of this object is ...
2
votes
1answer
145 views

Why don't the TLS1.3 cipher suites mention the key exchange and digital signature algorithm in names?

Does it mean both RSA and ECDSA certificates can be used with the same cipher suite?
2
votes
1answer
76 views

Can ECDSA key pairs be added up or multiplied?

I have been given a public key ($y_1=x_1G$), but I don't yet know the private key ($x_1$). At a later time, I will get $x_1$ if some conditions are met. Question: Let's say I generate a new key pair ...
2
votes
1answer
860 views

What is the maximum message size when using ECDSA (specifically secp256k1?

I'm guessing that the message must conform to 256 bits but I was not able to find documentation of any message length limits.
2
votes
1answer
715 views

Calculating random number in ECDSA based on private key and signature

In ECDSA (Elliptic Curve Digital Signature Algorithm) we use a random number k in the signature process. Signature in ECDSA is: $$ (x_1,y_1) = k * G $$ $$r = x_1 \...
2
votes
1answer
168 views

Why is DSA falling out of favor?

Windows abandoned DSA rather than extend it to support > 1024 bits; but otherwise I cannot find a reason why DSA would be less desirable. I see in SSH the disabling it by default with a completely ...
2
votes
1answer
1k views

Can I shorten the large ECDSA public key output file from OpenSSL?

I am working in a very bandwidth restricted environment where I from time to time have the need to distribute public keys. The distribution happens in bit format, so there is no need for encoding, at ...
2
votes
1answer
504 views

Can Secp 256 K1 curves “map” to a value on FIPS 186-3 or P-256?

I'm looking at Secp 256K1 vs UProve's FIPS 186-3 or P-256 implementation. Is there any relationship between the curves such that I can consistently "map" or "project" values from one curve to another?...
2
votes
1answer
882 views

Is using Ed25519 parameters in ECDSA safe?

I recently discovered the Curve25519 key exchange lib and the Ed25519 signature lib. Due to the speculations about NIST-designed curves, there is a chance that I ditch them and use the curves above ...
2
votes
1answer
287 views

Verify Messages to Embedded Device

I'm building an embedded device that I plan on distributing. Periodically the device will poll my server to check for updates and commands. I'd like the device to verify that any messages(JSON strings ...

1 2 3
4
5
8