Questions tagged [dsa]

The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.

Filter by
Sorted by
Tagged with
1
vote
0answers
38 views

Justification for the way s is computed in DSA? [duplicate]

I am sorry if this is a naive question but is there any justification for the way that s is computed in the DSA signature algorithm: $$ s = k^{-1} * (rx + m) $$ ...
1
vote
0answers
44 views

Is integrity important when building anonymity? [closed]

I was thinking about applying an anonymity process based on ECDSA signatures to anonymize blocks of information, not the public-key itself. Using a deterministic form of ECDSA to sign blocks and ...
1
vote
0answers
960 views

Diffie-Hellman combined with DSA/RSA

we have learned Diffie-Hellman, RSA and DSA (Digital Signature Algorithm) in university. Because DH is vulnerable of Man-in-the-Middle we had the task to program the DH combined with RSA to protect ...
1
vote
0answers
302 views

How to check the signature without the predetermined function in ECDSA from openssl? [closed]

I'm developing a client for a two-factor authentication in Qt/C++ under openSUSE 13.2, 64bit. I've got the FIDO U2F Security Key from yubico/fido. I'm using the classes from openssl, in particular <...
1
vote
0answers
309 views

verify fails on 3rd party after signing with BouncyCastle [closed]

I am using BouncyCastle to perform ECDH and then encrypt the data between the mobile (Android) and my hardware with ECIES. It all works fine. When I try to sign a byte array and send it to the ...
1
vote
0answers
62 views

Minimum length of PKI key for signature [duplicate]

I am looking for data which shows how time it would take to brute force (or crack by any other method) different sizes of RSA/DSA keys used for a digital signature. I am looking to use as small a ...
0
votes
1answer
174 views

Need help solving a puzzle (from a layperson) [closed]

As the title says, I'm a layperson when it comes to cryptography, so my question may not make absolute sense. Apologies in advance if this is vague. Here is the puzzle I'm presented with: You were ...
0
votes
1answer
388 views

Why are cryptographically secure hashes required for digital signing (RSA or DSA)?

I know that a cryptographically secure hashing algorithm is required for proper message signing (SHA-1, or I think SHA-2 is the current suggested algorithm). However, why does the hashing algorithm ...
0
votes
1answer
169 views

How to calculate kinv from the given k value

I am implementing an ECDSA NIST test vectors verification application. The test vectors are taken from http://csrc.nist.gov/groups/STM/cavp/#09. One of the test vectors is given below: ...
0
votes
2answers
309 views

Why does DSS have such formulas?

I've learnt the formulas needed for the DSA (http://en.wikipedia.org/wiki/Digital_Signature_Algorithm). But most importantly, I don't quite understand what represents those formulas and why they are ...
0
votes
1answer
277 views

ECDSA signing vs generating public key

I'm trying to understand the process of ECDSA signing. I already figured out the process of generating a public key out of a private key by multiplying the private key with G. The equation for ECDSA ...
0
votes
1answer
160 views

ECDSA: What is the purpose of adding a hash of the used certificate to the signed data?

I recently started looking into security mechanisms used for Car2Car communication according to DSRC/WAVE and ETSI. What I found so far is that each packet is signed using ECDSA mechanism. Also each ...
0
votes
2answers
544 views

DSA with composite p

One of the basic requirements of DSA is to choose some prime $p$ of certain bit length. The security then lies in the intractability of solving $y = g^x \pmod{p}$ for $x$. Is there any “easy” way to ...
0
votes
1answer
1k views

In ECDSA, without knowing private key and any signature one can sign random garbage (from the Cryptography list)

Taken from the Cryptography mailing list. It is claimed that in ECDSA, without knowing the private key and any message signed with it, one can sign: "random garbage" (there is some complicated ...
0
votes
1answer
238 views

Signature operations may leak the private key; signature verification should be safe?

What does this warning mean: Signature operations may leak the private key. Signature verification should be safe. A haskell cryto library displays the quoted warning above (see Crypto.PubKey.ECC....
0
votes
1answer
821 views

SHA1 collisions and the impact for ECDSA signatures

What will it mean for ECDSA using SHA1 when we have practical attacks breaking the collision resistance property of SHA1? [UPDATE] Added a bit more details to be clear. If $(r,s)$ is the ECDSA ...
0
votes
1answer
282 views

Why is it that in DSA, the order of the subgroup, $q$, is chosen such that it divides $p - 1$?

Consider the DSA key generation: A large prime $p$ is chosen; A smaller modulus $q$ is chosen such that $p - 1$ is a multiple of $q$; A generator $g$ s.t. $\operatorname{ord}_p(g) = q$ is chosen. My ...
0
votes
1answer
66 views

Is it secure to use ECDSA for any arbitrary point on the Elliptic Curve as the Generator point?

My question concerns the elliptic curve $E$ over a prime field $\mathbb F_p$. To the best of my understanding, ECDSA requires a Generator point $G$ of prime order $n$, and the $r$ and $s$ values of ...
0
votes
1answer
46 views

DSA authenticity/integrity

Does checking sig with DSA implies both that the sender is verified , and the msg is original without change of any bit? (case i dont have a reference HASH for that file, only public key)
0
votes
1answer
148 views

Are EdDSA algorithms encoded by ASN.1 DER standards?

Is it required, or widely practiced to encode a EdDSA signature as a ASN.1 Sequence? Why or why not? How should you encode a EdDSA signature? I cannot find mention of DER or ASN in the EdDSA RFC. ...
0
votes
1answer
47 views

Why create a subkey in the digital signature algorithm

In the signing step, wikipedia, a subkey is created. A key k is randomly chosen from 1..q-1. What's the use of that k? If the k is to make less exposure to the ...
0
votes
1answer
520 views

ECDSA recover on arbitrary values

If I were to supply arbitrary values to an ECDSA recover function on secp256k1, is there some likelihood that the function would fail to return some value for the public key? I am specifically trying ...
0
votes
1answer
453 views

How trivial is it to derive a private key from two public keys?

It turns out that what I was attempting to do was create a form of ECDSA threshold signature protocol by just giving away multiple public keys and then having the two parties solve for the private. ...
0
votes
1answer
555 views

How to convert ECDSA P256 curve signature to SECP256K1 curve?

I would like to get the ATECC608A microchip to sign data with ECDSA secp256k1 curve, but the chip only signs using the P256 curve. Is there an operation I can do using the original message and the ...
0
votes
1answer
403 views

Group signatures, security and ECDSA

I am reading up on group signatures. With RSA a public key can have more than one private key. For a public exponent $e$, private exponent $d$ and modulus $n$, there is more than one solution for the ...
0
votes
1answer
724 views

How to compute negative point in EC-DSA?

Assuming we have a valid EC-DSA signature $\sigma = (r,s)$. We can then easily create another valid signature without the knowledge of the secret key by negating $s$. That is, $\sigma' = (r, -s)$ can ...
0
votes
1answer
132 views

Calculating $s$ in ECDSA over $GF(2^m)$

I am implementing ECDSA over $GF(2^n)$. I am following RFC 6979 and compare my results with the example in Appendix A (which uses curve SECT163K1). My calculation of $r$ is correct, but I am ...
0
votes
1answer
252 views

ECDSA Verification - Last Steps

Reaching the end of an ECDSA signature verification, we need to compute multiple point multiplication and addition as following: $R=(x_R, y_R) = u_1G + u_2Q$, where $u_1$ and $u_2$ are scalars, $G$ is ...
0
votes
2answers
138 views

Stripping off message authentication or signature

If attackers can strip off RSA / EC / -DSA digital signature and conduct CCA on AES-CTR or CBC payload, why can't they do the same for AES-GCM?
0
votes
1answer
577 views

Comparison Affine Coordinates and Projective Coordinates Addition in Excel

Kurve : EC : $y^2=x^3 + x + 1$ Generator:$(1,7)$ $p=23$ Result in Affine use Excel: $P=(1,7)$, $Q=(7,11) \implies P+Q=(18,20)$ Result in Projective use Excel: $P=(1:7:1), Q=(7:11:1) \implies P+Q=(15:...
0
votes
1answer
34 views

Disk storage of RSA and DSA keys

I have generated one RSA-2048 signing key and one DSA-2048 signing key, using gpg command gpg --full-generate-keys I would expect the key to have size 2048 bits, ...
0
votes
1answer
91 views

ECDSA secp256k1 attacks

Are there any known and feasible ECDSA attacks on secp256k1 which can reduce the bit security of the algorithm? For example from 256 bits of security down to 192 bits?
0
votes
1answer
82 views

ECDSA public key point uniqueness [duplicate]

I'm new to ECDSA and there is something I still not sure about. If I have a classic Certificate Authority server that delivers PEM certificates containing public key with ECDSA, I can retrieve the ...
0
votes
2answers
293 views

Why doesn't the formula work when checking two ECDSA signatures?

There are two generated ECDSA signatures X - Private key S = ((Z + (X * R)) / K) mod n S` = ((Z` + (X * R`)) / K`) mod n G - Base point, of order n; ...
0
votes
1answer
373 views

ECDSA Signing and verifying signatures between Python and JS [closed]

I create a signature on js, here jsrsasign Signatures are obtained in the format: ...
0
votes
1answer
189 views

Regarding Lattice atttacks on ECDSA with a portion of known bits of the nonce k

I am new in the field of cryptography, and I am having some troubles understanding a concept regarding the lattice dimension needed in the attack on ECDSA using several messages with L known bits of ...
0
votes
1answer
397 views

decoding a Ed25519 key per RFC8032

RFC8032 Edwards-Curve Digital Signature Algorithm (EdDSA) 5.1.3 Decoding states the following: Decoding a point, given as a 32-octet string, is a little more complicated. First, interpret ...
0
votes
1answer
132 views

Sign + ETM in ECIES

Using ECIES in a file encryption protocol, I need to authenticate the sender, so I'm using ECDSA, and I'm wondering if signing the ephemeral public key(needed by receiver to derive the shared ...
0
votes
1answer
328 views

Is there a library-less implementation of DSA available to read? [closed]

Is there a pedagogical library-less implementation of DSA available to read? (Not ECDSA.) Obviously BigInteger and hash functions may be from libraries, but I want to read the implementation of all ...
0
votes
1answer
1k views

Key generation in Digital Signature Algorithm

In DSA, one needs to generate two primes $p$ and $q$ such that $q$ is $256$-bit and $p$ is $3072$-bit and $p-1$ is a multiple of $q$. Question: How to generate such $p$ and $q$. Attempt: First, use ...
0
votes
1answer
1k views

DSA generate signature and verify

I'm trying to generate a signature for DSA with the following parameters: $p = 23$ , $q = 11$ , $g = 3$ , $H(m) = 8$ , $x = 5$ for the life of me, I cannot choose a random $k$ ($0 > k > q$) ...
0
votes
0answers
17 views

Is it possible to safely implement the Signal Protocol (X3DH) without using XEdDSA

In the X3DH specification of the Signal Protocol it mentions having a signed pre-key in the key bundle. This pre-key is signed using the identity private-key. Because the identity private-key is in ...
0
votes
0answers
35 views

Bitcoin ECDSA signature

I am trying to use the ecdsaSign function in ecdsa.c of https://github.com/kvhnuke/Ethereum-Arduino/tree/master/Ethereum-Arduino/libs which is based on the files in the repo https://github.com/...
0
votes
0answers
61 views

Signing a secret key with ECDSA

Assume Alice and Bob both separately come into possession of the same randomly generated 256 bit secret key. Alice has Bob's public ECDSA key. Alice wants to verify that Bob has possession of the ...
0
votes
0answers
15 views

Complexity upper bound MFC DSA with linear S-Box

in advance, excuse my eventuelly bad english. It's not my mother tongue. I work on a coolege Computer Science Project. For this, i need to know the upper bound of the complexity for the MFC( Formal ...
0
votes
1answer
39 views

ECDH Public Key Recovery - Determine if valid key exists from just signature and message

If I have just the (r,s,v) values of the signature and the message hash, what is the most efficient way to determine if a valid public key exists? I do not need to know the public key, just that the ...
0
votes
0answers
76 views

Comparisons of ECDSA, EdDSA and BLS Signatures in Blockchain: Pros and Cons

As we know, the most used digital scheme in Blockchain is ECDSA. For now, more and more blockchain projects, I've noticed, are considering substituting EdDSA and BLS signature scheme as the new one. ...
0
votes
0answers
44 views

In DSA digital signature, why does k have to be random and unique each for each signing? [duplicate]

If we repeat k, I think there is little chance for s to repeat since user's private key x is ...
0
votes
0answers
40 views

Signing with ECDSA [duplicate]

I am new to ECC. I was reading this post https://andrea.corbellini.name/2015/05/30/elliptic-curve-cryptography-ecdh-and-ecdsa/ I want to know if there is any intuition behind the following formula: $...
0
votes
0answers
41 views

ECDSA dA multiplication algorithm [duplicate]

I was looking at this question and i can`t understand this part: QA = dA G = 5 (5,1) = (9,16) I saw that algorithm used for this was Double-and-add algorithm but i didn't get it. Can anyone explain ...

1
4 5 6
7
8