Questions tagged [dsa]

The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.

Filter by
Sorted by
Tagged with
1
vote
1answer
512 views

Can a TLS certificate using ECC secp384r1 as PK algorithm uses RSA for signature

If a TLS certificate public-key algorithm is ECC secp384r1 or ECC prime256v1, is it possible to have RSA as a signature ...
1
vote
1answer
260 views

DSA signature generation [duplicate]

I am trying to implement given DSA signature generation instructions in python, there are few instructions that I couldn't understand in step 3 and 4. Let m be an arbitrary length message. The ...
1
vote
1answer
79 views

Does the XML signature standard support Ed25519?

https://www.w3.org/2008/xmlsec/Drafts/xmldsig-core-20/#sec-ECKeyValue talks about ECDSA but even the explicit curve parameter stuff won't work with Ed25519 as Ed25519 has a completely different ...
1
vote
1answer
3k views

ECDSA non random k - Retrieve private key [closed]

At the moment I'm playing around with ECDSA. I know that I can retrieve the private key if the same K is used to sign two messages. I tried to use this script: Ruby Script to crack the private key. ...
1
vote
1answer
36 views

X.509 ECDSA signature field in DER format includes '00' between bit string and sequence of r and s

I created a X.509 certificate with ECDSAwithSHA256(OID=1.2.840.10045.4.3.2) by openssl. ECC parameter is secp256r1. Following is the signatureAlgorithm and signatureValue. ...
1
vote
2answers
63 views

How to properly sign and verify using DSA? Can anyone spot my mistake?

The question that I am trying to answer is as follows: 10.14. The parameters of DSA are given by p = 59,q = 29,α = 3, and Bob’s private key is d = 23. Show the process of signing (Bob) and ...
1
vote
1answer
119 views

Why is a prime number used in ECDSA?

So I need to write a piece for school about ECDSA and how it is secure. Now I thought I had a simple question, however, I can't seem to find an answer anywhere: Why does the p in the formula need to ...
1
vote
1answer
85 views

DSA - can $k$ be 1?

I'm learning DSA and I'm wondering if $k$ can be 1. I know that k has to be from $\mathbb{Z}_{q-1}$ but I don't know whether 1 is allowed (not talking about security concerns, purely educational). I ...
1
vote
1answer
84 views

Is this API for ECDSA signature verification consistent with NIST test vectors?

I'm trying to use code from "Easy ECC" package (a github project), for ECDSA-verifying a signature. The problem I'm facing is that the API assumes a public key length of N+1, which is different than ...
1
vote
1answer
4k views

What is the recommended minimum key length for ECDSA signature

I want to identify the proportion of certificates that use unrecommend ECDSA key length for TLS certificates based on some data I collected. By looking at a standard like NIST for example, I find ...
1
vote
1answer
626 views

How fast a middle-class computer can verify assymetric signatures (like ECDSA, RSA etc.)?

I have an idea for a peer-to-peer network that will require every connected peer to verify many symmetric signatures per second. In bitcoin, it's the same - every peer independently verifies ...
1
vote
1answer
125 views

Requirements for attacker-controlled ECDSA identity point signature

Wikipedia's description of the ECDSA verification algorithm suggests verifiers should confirm that step 6 doesn't produce the identity point: Calculate the curve point ${(x_{1},y_{1})=u_{1}G + u_{...
1
vote
1answer
1k views

Is there any ECDSA Attack if I have millions of signatures?

I have been given the task to test the security of our company software. Our company software generates ecdsa signed supply order files. One can generate as many files as he wants. so my question is ...
1
vote
1answer
626 views

Downsides of not using deterministic ECDSA signatures for blockchain validation?

I've noticed that in many Bitcoin wallet implementations, as well as other blockchains, deterministic ECDSA signatures are being used (generally based on RFC 6979). There seems to be some benefits to ...
1
vote
1answer
585 views

Challenge Response at Application Layer of BLE using ECDSA

There is a need for an Offline BLE device to Auth a Phone. I am planning to use challenge response somewhat outlined here. There is a small change. Instead of shared secret. I am planning to use a ...
1
vote
1answer
5k views

Length of ECDSA signature

I am using "secp192k1" curve to generate the key for data signing using ECDSA scheme. Signature is generated using "SHA3-256withECDSA" algorithm provided by BouncyCastle. Theoretically, the length of ...
1
vote
1answer
96 views

Hybrid authenticated protocol

Let's suppose that two entities, A and B, are establishing a secure channel and then require a mutual authentication. A has only a RSA key pair and B has an ECDSA key pair. Both of them trust the ...
1
vote
3answers
1k views

Which hash function is used for signatures ssh-rsa and ssh-dss?

I'm building a fuse client for ssh/sftp. I write the required ssh and sftp functions myself. Now I read in RFC4253 that before signing the data to sign is default hashed. In RFC4253 8. "Diffie-Hellman ...
1
vote
1answer
726 views

Does OpenSSL apply ASN1 encoding to the hash before signing using ECDSA?

I read on stack overflow that OpenSSL performs ASN1 encoding to the hash before signing it for, for ECDSA. In other words, OpenSSL performs the following steps when for an Elliptic curve key ...
1
vote
1answer
102 views

What happens when domain parameter $q$ in DSA is not prime number

Suppose that attacker creates domain parameters $(p,q,g)$ where $q$ is not prime number (but $q$ still divides $p-1$) and that signer generates new key pair using these domain parameters. How exactly ...
1
vote
2answers
569 views

ECDSA Public key randomness

If I have a 256bit ECDSA public key how likely is it that the same public key will be generated by another person. Will it take on average 2^256 tries to generate same public key? If I xor the first ...
1
vote
1answer
509 views

request for data to test deterministic ecdsa signature algorithm for secp256k1

I’m implementing the RFC 6979 procedure to compute a message signature. I want to test my program on the secp256k1 elliptic curve. Note the “k” in secp256k1, i.e. the Koblitz curve. If you have the ...
1
vote
1answer
86 views

How Does Prime Factorization Break ECDSA?

I have heard that ECDSA will be broken in the not-to-distant future (roughly 15-25 years) by Quantum Computers running Shor's Algorithm. However, to my understanding, the only purpose of Shor's ...
1
vote
1answer
235 views

Simple math ECDSA example

I'm trying to setup an ECDSA math example using just integer math and multiply (no EC). The purpose is just to help people understand why this works with out the added complication of understanding ...
1
vote
1answer
214 views

openSSL and ECDSA key format inspection

If I run openssl ec on a key that I have generated with openssl ecparam -genkey I get one extra prefixing 0x00 in the private ...
1
vote
1answer
153 views

Known risks for publishing ECDSA public keys and signatures

For an implementation of ECDSA, I'm considering the risks of publishing public keys together with multiple signatures. From what Google tells me, a common pitfall is the use of the same random value ...
1
vote
1answer
313 views

In ECDSA, why are u and v dividing by s?

The verification algorithm for ECDSA is: $P=e\times G$, $(r,y)=k\times G$, and $s=(z+re)\times k^{-1} \bmod n$, where $P$ is the public curve point, $G$ is the generator point, $e$ is the ...
1
vote
1answer
417 views

Is using ECDSA with AES-GCM viable?

I'm pretty new to the whole cryptography scene, so please forgive me if I make any incorrect statements. I have a 16MB image that I'm encrypting and authenticating using AES-GCM. I obtain a 16MB ...
1
vote
1answer
268 views

Obtain Information about hash algorithm from ECDSA public key

I have an ECDSA Public Key in DER Format. I viewed the file in an ASN1 Editor and there's the OID 1.2.840.10045.1.1 whose superior (...
1
vote
1answer
749 views

Can I use a random number generator with seed for key derivation?

I don't know a thing about cryptography so I'm judging by what I see in APIs docs. I want to use ECDSA or ECDH in my project. And what I know so far about key derivation in this systems is that they: ...
1
vote
1answer
461 views

DH Key exchange attack: bad choice of g

In the group $\mathbb{F}_p^*$, Bob reads Alice's parameters as $p=234917$ and $g=281$ and uses a secret key $b < 400$ such that $h_b = g^b = 92646$. Note that $p-1 = 2^2\cdot 11\cdot19\cdot281$ $...
1
vote
1answer
243 views

Finding public key out of ECDSA certificate

I got an ECDSA certificate and now I'm trying to find out the public key. I'm not very familiar with this topic, so I hope you bear my (maybe silly question). The reason I'm doing this is, because my ...
1
vote
1answer
342 views

Getting a key size of DSA/Elgamal certificate

I've tried to get a public key size of DSA/Elgamal PGP certificate. Using the Cleopatra I find out that there is actually two public keys - one with DSA with key ...
1
vote
1answer
590 views

Better security than SHA1 for signature?

An application that I maintain uses Sparkle Update to update itself. I expect attacks from high level attackers (China, USA's NSA, etc.) and have some questions about how secure the cryptography ...
1
vote
1answer
271 views

With ECDSA is there a way for the verifier to calculate any properties of $k$?

With ECDSA, given $(r,s)$ and $m$, is there a way for a verifier to calculate any (boolean) properties of $k$, without knowing $k$ or the private key $D_A$? (I understand that $k$ should be random, ...
1
vote
1answer
102 views

DSA: Authentication and assurance of authorized parties

When dealing with Asymmetric cryptographic algorithms, usually the sender of the critical data asks the listener for a Public Key for encrypting the data and sending them. This is while the private ...
1
vote
1answer
656 views

ECDSA: Retrieving non-random k [duplicate]

I have a question regarding the random $k$ number of ECDSA encryption. As far as I know, it is possible to retrieve $k$ (and thus the private key) from two signed messages if both used the same $k$. ...
1
vote
1answer
674 views

If H(m) = 0 for some m, how can a DSA signature be forged?

If we know for some message $m$ that $H(m) = 0$, how can we forge a DSA signature with only the public key? I got that $g^s*r = (g^x)^r$ where $x$ is the private key, but that's one equation with 2 ...
1
vote
1answer
293 views

Request for 1024-bit primes $p$ , subgroup $q$ and subgroup generator $g$

I need to find a prime $p$ of $1024$ bits with a $160$ bit sub group size $q$, such that $q|p-1$ , and $g$ is the generator of the sub group size $q$. I'm looking for the numeric values of $p$ , $q$ ...
1
vote
1answer
378 views

ECDSA - point order criterion

i am creating some primitive demostration for ECDSA over small curve (p < 229). But my implementation have some weird issues. Verify process return false even if the signature is correct. Because I ...
1
vote
0answers
49 views

Difference and relation between ed25519, x25519 and XEd25519 [duplicate]

In my Rust implementation of a messaging system, I'm using currently two cryptographic primitives: ed25519_dalek and x25519_dalek. I use ed25519_dalek for DSA, while x25519_dalek for encryption of the ...
1
vote
0answers
42 views

Zero Knowledge Proof of Association

Assuming there are a group of individuals with static ecdsa keypairs, of which the public keys are in a shared database that all of them have access to, how can each participant publish an ephemeral ...
1
vote
1answer
87 views

ECDSA signature of a random 32 byte number vs. the hash of the number

I'm working on an application that involves signing a 32 byte random number generated by the OS. Assuming the RNG works as intended, is it safe to sign the random number itself rather than a hash of ...
1
vote
0answers
66 views

ECDSA - why is the first part of the signature used in the second?

Using the terminology of https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm Why is the second part of the ECDSA signature defined as: $s = k^{-1}(z+rd_A)\text{ mod n}$ ...
1
vote
1answer
123 views

Where can I find the standard definition for GPG ECDSA signature?

I am playing around with GPG which I'd like to use to sign an integer and use the resulting signature binary in another piece of code. So far I have created a simple PGP packet parser with which I ...
1
vote
0answers
49 views

Proof insecure DSA variant [duplicate]

Consider a variant of DSA in which the message space is $\mathbb Z_q$ and the hash function is replaced by the identity function. (So the second component of the signature is now $s := k^{−1} \...
1
vote
0answers
237 views

ECDSA Message Recovery from Two Encrypted Messages with Signatures and Public Key

I am currently working on a problem where I have two encrypted messages, their corresponding signatures, and the public key. Furthermore, the value of $r$ is the same in the two signatures. I am ...
1
vote
0answers
45 views

How to prove two ECDSA public keys on two different curves are generated from the same private key [duplicate]

I wonder if I provide someone with two public keys from different elliptic curves, is there any way to prove that these two public keys are generated from the same private key without revealing the ...
1
vote
0answers
48 views

Linkable ECDSA like signature [closed]

In our process of digital checks for banking - which needs to work online and offline - the receiver needs to know the chain of all generated signatures without consulting an Internet service. In this ...
1
vote
1answer
645 views

ECDSA vulnerability related to recovering private key using same r [closed]

I'm considering this for bitcoin transaction as it uses ECDSA so if the signer generates two signatures suppose s1 and s2. where: I get it that any attacker who have s1 and s2 can recover its private ...

1
4 5
6
7 8