Questions tagged [hash-signature]

Signature schemes built out of and based on properties of hash functions. **DO NOT USE THIS TAG** if the signature is based on other hard problems and just happen to employ a hash function.

Filter by
Sorted by
Tagged with
0 votes
1 answer
19 views

What is the best possible security for authentication of entity?

The classical security for authentication is computational provided by RSA or EC based signatures. With the advent of new PQ schemes the security claims are upgraded though nothing is proved. So the ...
Viren Sule's user avatar
0 votes
0 answers
21 views

Implement true serverless (decentralized) online multiplayer game with cryptography

TLDR, this will be a discussion rather than my private problem. Nowadays, most game developers or publishers have central servers to manage player transactions such as movement, mouse position, and so ...
Muhammad Ikhwan Perwira's user avatar
1 vote
1 answer
42 views

Signing a file vs. a manifest of cryptographic hashes

I’m interested in the tradeoffs of signing individual files vs. signing a manifest of cryptographic hashes and file names. Let’s say I do some work that results in a handful of files (10s to hundreds),...
baseboard49's user avatar
0 votes
1 answer
44 views

How IKE authentication happens? what's the role of HASH_I & HASH_R, and how it gets verified by each parties? and where SKEYID_a gets engaged?

Dears, In RFC 2409 "The Internet Key Exchange (IKE)", its mentioned there are four available authentication methods for IKE, there are different calculations for SKEYID for each method and ...
Asem's user avatar
  • 1
0 votes
0 answers
64 views

How to prove that signature hash is wrong without reveal message

Let's say we have Bob, Alice and third party. Bob make message signature hash and upload to third party, then encrypt message with Alice pub key and send it to Alice Alice receive message and decrypt ...
byXrom's user avatar
  • 3
0 votes
1 answer
131 views

How does FORS: Forest of Random Subsets work?

I saw a post named "How does signing with FORS work in SPHINCS+?" but in the post it seems like no one had explain how does the FORS works. SK: Secret Key, PRF: Pseudo-Random Function I'm ...
a15600712's user avatar
0 votes
0 answers
30 views

Is hashing really enough for data integrity or needs signing? [duplicate]

Hashing functions are used for data integrity when integrated with signing asymmetric algorithms but I miss a step. In multiple sources like here or here I read for granted that hashing algorithm per ...
Tarta's user avatar
  • 129
0 votes
1 answer
66 views

What are the statefulness and signature count limits of SPHINCS+?

SPHINCS+ is an interesting post-quantum algorithm, and I'm curious about what its limitations are. What I know about hash-based signature formats in the past are that you needed to remember which ...
Myria's user avatar
  • 2,575
1 vote
2 answers
2k views

Why is SHA256 used as a layer on top of Digital Signature [duplicate]

Digital Signatures use an asymmetric algorithm, meaning that if I want to apply a digital signature to a document I sign it with my own private key and send it to the recipient. The recipient, thanks ...
Tarta's user avatar
  • 129
1 vote
1 answer
200 views

Cryptography to tackle deepfake, proving the photo is original

Deepfake technology has become very difficult to tackle due to sophisticated machine learning algorithms. Now, even when a journalist or bystander provides photo or video evidence, the culprit denies ...
Amiya Behera's user avatar
0 votes
2 answers
233 views

NIST PQC: minimum number of digital signatures

I've been checking the NIST PQC documents to find the requirements about the minimum required numbers of signatures to be generated with a signature scheme: NIST call for proposals Call for ...
radix's user avatar
  • 101
0 votes
2 answers
537 views

Best cryptographic method to distribute license files

I will describe my problem high-level, and not ask a very specific cryptographic question, since I am open for general suggestions as well. So in my question I will only speak about "security ...
Allgaeuer's user avatar
  • 123
1 vote
0 answers
26 views

Curious behavior of EVP_DigestSign for DKIM

Difficulties porting code to OpenSSL 3 may raise some doubts on digest signing. Before version 3 came, digest signing was the only way to use ED25519. On version 3, RSA_sign() being deprecated, I ...
Ale's user avatar
  • 111
1 vote
1 answer
63 views

What happens when a Merkle Tree OTS scheme runs out of keys

A Merkle Tree OTS scheme such as XMSS pregenerates 2^h keys that are tied to 1 public key When the 2^h keys run out, does all the 2^h keys get removed/deleted and the device pregenerates another new 2^...
Vincent Lew's user avatar
1 vote
1 answer
104 views

Regarding the Digital Signature Algorithm During Client Authentication in TLS 1.2

In TLS 1.2, when client authentication is carried out, digital signatures are utilized. However, at what point is the specific signature algorithm communicated to the server? It seems to me that the ...
dusk's user avatar
  • 11
0 votes
1 answer
63 views

Can I verify a message with Openssl if it was sign with .Net System.Security.Cryptography?

Sorry, this is sort of a beginner question. But providing that it is possible to find the same options, can I verify a message with Openssl if it was sign with .Net System.Security.Cryptography ? Let'...
Jimbot's user avatar
  • 103
1 vote
1 answer
45 views

PRNG to Obtain Random Subset (PORS) Success Probability

PORS (PRNG to ORS) is a secure variant of the HORS few-time signature scheme. In PORS, instead of using a hash function, it uses a message (and salt) as a seed of PRNG and query it until obtains k ...
Emma's user avatar
  • 11
2 votes
1 answer
126 views

Post-quantum EU-CMA security from OWF-only

In the paper: "Universal One-Way Hash Functions and their Cryptographic Applications". The following is proven: "If 1-1 one-way functions exist, then the one-way based signature scheme ...
Ilk's user avatar
  • 233
2 votes
1 answer
106 views

Bit flipping attack in hash function for message authentication

In this picture we have a use of a hash function for message authentication. M is plaintext message. H is hash function. E is encryption block with K symmetric key. || is concatenation of plaintext M ...
Allexj's user avatar
  • 143
2 votes
0 answers
413 views

How to hash a JWT signature using Public & private key (Have both key in JSON format & X.509 PEM Format), using ES256 algo for JWT

I want to hash my signature of JWT using public & private key, since we are using ES-256 algorithm in JWT. But the problem is that I have both the keys in JSON & .PEM format, so how can I do ...
Amit Mishra's user avatar
1 vote
1 answer
1k views

best HMACSHA signed JWT secret length

I would like to use JWT but one thing I'm still thinking is ¿what is the best length for the secret? If I'm using HS512 as a signing method the secret should have a length of 512 bits as far as I ...
Clara Raquel's user avatar
1 vote
1 answer
62 views

LMS hash calls formula?

If we consider LMS with (SHA256 and LMS-OTS as the OTS scheme) as defined in sections 5 and 4 here: https://datatracker.ietf.org/doc/html/rfc8554#section-5, they provide the following formulas for LMS-...
destrand's user avatar
1 vote
1 answer
189 views

Code Singing Parameters for LMS/HSS/XMSS

LMS is specially used for applications, such as code-signing (https://csrc.nist.gov/CSRC/media/Publications/white-paper/2018/01/26/security-considerations-for-code-signing/final/documents/security-...
destrand's user avatar
3 votes
1 answer
880 views

What is "one-time signature"

I'm studying the post-quantum cryptography (PQC). While studying hash-based pqc, I read a thesis about Winternitz one-time signature scheme (W-OTS). What is the exact definition of "One-time ...
bjkim's user avatar
  • 31
2 votes
1 answer
84 views

FORS and DFORS Few time signature Security level

I was reading the FORS and DFORS Few-Time-Signature scheme. I understood the security of HORS Few time signature equals to $ (rk/t)^k $, but I could not understand the security of FORS is $ (r/t)^k $ ...
Alicia's user avatar
  • 23
0 votes
0 answers
85 views

Security proof of the Schnorr Signature

How Schnorr signature security can be proved for signature forgery, replacement, and Replay attacks?
SHI MA's user avatar
  • 1
2 votes
0 answers
33 views

If rabin signature uses a hash function then why cant we use that hash function to sign a message?

About Rabin Signature link According to this paper, the person who wants to sign a message M first appends a random byte string U. => M_new = MU Then uses a compression function to get c = ...
void_117's user avatar
2 votes
1 answer
140 views

How to prove that two hashes correspond to the same original message, without using the message to verify?

Let's suppose this: Message is "I love crypto.stackexchange.com" (M) Bob creates hash H1 with the message M and his private key (Priv) Alice receives a message X, and hash H2 with message X ...
JeremyDEX's user avatar
0 votes
1 answer
90 views

LMS signatures : Complexity of Classic Merkle Tree Traversal

I'm trying to understand the complexity of computing the Merkle root for stateful hash based signature schemes. Section 4.1 of the chapter on hash based signatures in "Post Quantum Cryptography&...
Rohit Khera's user avatar
0 votes
1 answer
189 views

Is it impossible to extract any data from an ECDSA signature of hashed data

I am trying to write a function that, given an EIP712 ECDSA signature, verifies the signature was signed by a particular person, and then (somehow) retrieves the information that is encoded in the ...
Barney Chambers's user avatar
0 votes
2 answers
93 views

Is there any way to claculate the hash of (a + b +c)) if you only know hash(a) and Hash(b) and Hash(c)?

For example, if you have say, 3 distinct paragraphs of clear text a, b, c and you only know hash(a), hash(b) and hash(c), and then you have a clear text d, which claims to be the concatenation of a, b,...
GGizmos's user avatar
  • 101
2 votes
1 answer
111 views

Lattice-based Signatures and Hashes

Although many different lattice-based signature schemes exist, Hash and Sign signatures schemes, like [GPV08], are prevalent. On the other hand, it is well known that collision-resistant hash ...
Carlos Ribeiro's user avatar
1 vote
1 answer
158 views

Comparing stateful hash-based signatures to group-based signatures

Some applications may require quick transition to post-quantum signatures, and stateful hash-based signatures fill that role (cf. CNSA 2.0). My question is (ignoring statefullness, focusing on space/...
yoyo's user avatar
  • 420
-1 votes
3 answers
550 views

Which of the following is a reason to publish files' hashes?

To valiate integrity or To verify if the software is digitally signed The question seems wrong to me. I do not see any reason to publish(make public) a hash. But it is in the material I am studying.
Abdulaziz's user avatar
2 votes
1 answer
197 views

Zk Proof to Prove that I know the secret x of y = HASH(x)

Lets say I know a secret value x. The hash of x, y = H(x) is public. Is there any zk way to ...
Zubayr's user avatar
  • 123
0 votes
2 answers
104 views

Is there any Cryptographic loop function that returns first input?

I want to use cryptographic function that returns the initial input or something related to it like its hash, the function should work like Encrypting some data or its hash, then encrypt the output of ...
Mohamed A. Taha's user avatar
1 vote
2 answers
99 views

Generalized Haircomb OTS vs Winternitz OTS at 256bit hash security level

Suppose a 256 bit hash is used (SHA2, SHA3, ...). How does the Winternitz OTS perform at various signature sizes? I'd want to compare to a generalized K-teeth Haircomb: It's signature is $K$ of these ...
Hugo Franklin's user avatar
-2 votes
1 answer
208 views

Why does the comb of Natasha Otomoski have 21 teeth? [closed]

What is the signature size of Natasha Otomoski haircomb? What is the number of invocations of the underlying one way hash function for key generation, signature, and verification? How does it compare ...
Hugo Franklin's user avatar
3 votes
1 answer
144 views

Alter SPHINCS+ to have collision probability=0 and remove entropy source when signing

If you alter the SPHINCS+ signature scheme such that the number of signatures it can sign is the same as the number of hashes the hashing algorithm can output such that for example if you have a 2^256 ...
Leanne K.'s user avatar
1 vote
1 answer
123 views

Stateful hash signature without Merkle trees

When it comes to stateful schemes, would you really need to use a Merkle tree? Couldn't you sign the hash of the message concatenated to the hash of the new public key? New public key: hash(hash(...
Lauren Fen.'s user avatar
0 votes
1 answer
72 views

How come we only need to generate the first tree in each layer in XMSS MT

From what I understand, to reduce the time taken for public key generation, you can use nested trees in XMSS to form Multi-tree XMSS. For an instantion of 2 layers, it seems that the leaf of each L ...
João Diogo Duarte's user avatar
0 votes
1 answer
875 views

Signing a hash of file vs signing a file

If person A generated a hash (e.g sha256) of a file and then signed the hash using a private key. Given person B only has the public key, file, signature and the hash, would verifying the signature ...
Simon C's user avatar
  • 109
1 vote
1 answer
80 views

A CERTIFIED DIGITAL SIGNATURE paper pg 20 - 25

Reference paper: "A CERTIFIED DIGITAL SIGNATURE" With reference to the image above which is from Page 20 of the attached paper. What is this new protocol that the paper speaks of here? What ...
redd's user avatar
  • 55
2 votes
1 answer
212 views

Questions on "A CERTIFIED DIGITAL SIGNATURE" Pg. 19

Referenced paper here. The above excerpt is from Page 19 of attached paper. I have a few questions. y = F^9(x) is equivalent of F(F(F(F(F(F(F(F(F(x))))))))) ? The excerpt says that this allows us to ...
redd's user avatar
  • 55
2 votes
1 answer
342 views

Lamport Diffie One-time Signature

I am going through the Lamport Diffie One-time signature. I am having a hard time understanding How can long messages (greater than 100 bits) can be mapped into short messages (100 bits) by a one way ...
redd's user avatar
  • 55
0 votes
0 answers
127 views

Is there a cryptography algorithm for signing values with two keys and requiring both to verify it?

Is there an algorithm that lets me sign a value with two keys at the same time, and in turn requires both keys to verify the signature? For instance, a scheme could work like this: Sign X with Key1 ...
eja's user avatar
  • 101
1 vote
0 answers
107 views

How to find strength of a cryptographic hash function?

I am having an idea to create a cryptographic hashing algorithm. I found a mathematical function $f: x \rightarrow y$ . By using Merkle-Damgård construction wide pipe, I designed a hashing function. ...
manda sukresh's user avatar
1 vote
1 answer
703 views

Why are WOTS and WOTS+ one-time schemes?

I've been doing some reading on hash based signature schemes, specifically XMSS and thus the underlying Winternitz scheme (WOTS+ to be precise). As their names suggests, WOTS and WOTS+ are one time ...
Dennis8's user avatar
  • 13
1 vote
1 answer
164 views

Why do we need both bitmasks and keyed hash in SPHINCS+

I think one of them is related to multitarget attacks and the other is related to collision attacks. But I cannot find how hash based crypto related to hash collisions. 1-) Consider the following ...
user's user avatar
  • 173
2 votes
0 answers
87 views

Hash verification by key

I want to implement the following algorithm, but don't know what tools to use. D - data I generate some universal value for D - Y I generate some random key - K, get a hash of D by this key - H I ...
ischenko's user avatar