Skip to main content

Questions tagged [hash-signature]

Signature schemes built out of and based on properties of hash functions. **DO NOT USE THIS TAG** if the signature is based on other hard problems and just happen to employ a hash function.

Filter by
Sorted by
Tagged with
2 votes
0 answers
37 views

I need a good Hash function for folding 64bits into 32bits. I need to map 64bit variables into a 32bit representation

I am using a murmurhash implementation to fold 64bit (uint64_t) values into 32 bits (uint32_t). To my surprise, I discovered that there were some collisions on 64bit values that only differ by a ...
PlagiarismGuardian's user avatar
2 votes
1 answer
204 views

Correct my understanding of Digital Signature Algorithm for TLS certificates?

I just read the Wikipedia page on the Digital Signature Algorithm here: https://en.wikipedia.org/wiki/Digital_Signature_Algorithm Is the signing algorithm explained on the page the one that is used by ...
learningtech's user avatar
0 votes
1 answer
44 views

Is shared secret and SKEYID are same in the IPSec?

I want to know that, is shared secret and SKEYID are same in the IPSec? I knew that from SKEYID, three further keys are generated (derivative, authentication and encryption). But from where this ...
Tech Learner's user avatar
0 votes
1 answer
35 views

Digest Signing for GPG Packages

We're currently using file type-specific signing tools (textsign, helmsign, rpmsign) for GPG packages, creating network strain by transmitting entire packages to a signing server. To optimize this, we'...
undefined's user avatar
  • 103
0 votes
0 answers
29 views

i want to verify the following p2pkh transaction

I know to veify the p2pkh transaction we have to place the unlocking script and locking script in a stack and than evalute the stack. In such cases the the scriptpubkey_asm is of the form <OP_DUP ...
Code's user avatar
  • 1
1 vote
0 answers
67 views

I do not understand the result of 'proposition 2' of "MDx-MAC and building fast MACs from hash functions"

I saw the difference between the proof and the statement of "proposition 2" in the paper "MDx-MAC and building fast MACs from hash functions" by Bart Preneel & Paul C. van ...
hellobc's user avatar
  • 31
1 vote
1 answer
29 views

What is the best possible security for authentication of entity?

The classical security for authentication is computational provided by RSA or EC based signatures. With the advent of new PQ schemes the security claims are upgraded though nothing is proved. So the ...
Viren Sule's user avatar
0 votes
0 answers
30 views

Implement true serverless (decentralized) online multiplayer game with cryptography

TLDR, this will be a discussion rather than my private problem. Nowadays, most game developers or publishers have central servers to manage player transactions such as movement, mouse position, and so ...
Muhammad Ikhwan Perwira's user avatar
1 vote
1 answer
57 views

Signing a file vs. a manifest of cryptographic hashes

I’m interested in the tradeoffs of signing individual files vs. signing a manifest of cryptographic hashes and file names. Let’s say I do some work that results in a handful of files (10s to hundreds),...
baseboard49's user avatar
0 votes
1 answer
60 views

How IKE authentication happens? what's the role of HASH_I & HASH_R, and how it gets verified by each parties? and where SKEYID_a gets engaged?

Dears, In RFC 2409 "The Internet Key Exchange (IKE)", its mentioned there are four available authentication methods for IKE, there are different calculations for SKEYID for each method and ...
Asem's user avatar
  • 1
0 votes
0 answers
66 views

How to prove that signature hash is wrong without reveal message

Let's say we have Bob, Alice and third party. Bob make message signature hash and upload to third party, then encrypt message with Alice pub key and send it to Alice Alice receive message and decrypt ...
byXrom's user avatar
  • 3
0 votes
1 answer
173 views

How does FORS: Forest of Random Subsets work?

I saw a post named "How does signing with FORS work in SPHINCS+?" but in the post it seems like no one had explain how does the FORS works. SK: Secret Key, PRF: Pseudo-Random Function I'm ...
a15600712's user avatar
0 votes
0 answers
30 views

Is hashing really enough for data integrity or needs signing? [duplicate]

Hashing functions are used for data integrity when integrated with signing asymmetric algorithms but I miss a step. In multiple sources like here or here I read for granted that hashing algorithm per ...
Tarta's user avatar
  • 129
0 votes
1 answer
92 views

What are the statefulness and signature count limits of SPHINCS+?

SPHINCS+ is an interesting post-quantum algorithm, and I'm curious about what its limitations are. What I know about hash-based signature formats in the past are that you needed to remember which ...
Myria's user avatar
  • 2,595
1 vote
2 answers
2k views

Why is SHA256 used as a layer on top of Digital Signature [duplicate]

Digital Signatures use an asymmetric algorithm, meaning that if I want to apply a digital signature to a document I sign it with my own private key and send it to the recipient. The recipient, thanks ...
Tarta's user avatar
  • 129
1 vote
1 answer
218 views

Cryptography to tackle deepfake, proving the photo is original

Deepfake technology has become very difficult to tackle due to sophisticated machine learning algorithms. Now, even when a journalist or bystander provides photo or video evidence, the culprit denies ...
Amiya Behera's user avatar
0 votes
2 answers
243 views

NIST PQC: minimum number of digital signatures

I've been checking the NIST PQC documents to find the requirements about the minimum required numbers of signatures to be generated with a signature scheme: NIST call for proposals Call for ...
radix's user avatar
  • 101
0 votes
2 answers
637 views

Best cryptographic method to distribute license files

I will describe my problem high-level, and not ask a very specific cryptographic question, since I am open for general suggestions as well. So in my question I will only speak about "security ...
Allgaeuer's user avatar
  • 123
1 vote
0 answers
33 views

Curious behavior of EVP_DigestSign for DKIM

Difficulties porting code to OpenSSL 3 may raise some doubts on digest signing. Before version 3 came, digest signing was the only way to use ED25519. On version 3, RSA_sign() being deprecated, I ...
Ale's user avatar
  • 111
1 vote
1 answer
68 views

What happens when a Merkle Tree OTS scheme runs out of keys

A Merkle Tree OTS scheme such as XMSS pregenerates 2^h keys that are tied to 1 public key When the 2^h keys run out, does all the 2^h keys get removed/deleted and the device pregenerates another new 2^...
Vincent Lew's user avatar
1 vote
1 answer
170 views

Regarding the Digital Signature Algorithm During Client Authentication in TLS 1.2

In TLS 1.2, when client authentication is carried out, digital signatures are utilized. However, at what point is the specific signature algorithm communicated to the server? It seems to me that the ...
dusk's user avatar
  • 11
0 votes
0 answers
78 views

Can I verify a message with Openssl if it was sign with .Net System.Security.Cryptography?

Sorry, this is sort of a beginner question. But providing that it is possible to find the same options, can I verify a message with Openssl if it was sign with .Net System.Security.Cryptography ? Let'...
Jimbot's user avatar
  • 103
1 vote
1 answer
46 views

PRNG to Obtain Random Subset (PORS) Success Probability

PORS (PRNG to ORS) is a secure variant of the HORS few-time signature scheme. In PORS, instead of using a hash function, it uses a message (and salt) as a seed of PRNG and query it until obtains k ...
Emma's user avatar
  • 11
2 votes
1 answer
145 views

Post-quantum EU-CMA security from OWF-only

In the paper: "Universal One-Way Hash Functions and their Cryptographic Applications". The following is proven: "If 1-1 one-way functions exist, then the one-way based signature scheme ...
Ilk's user avatar
  • 233
2 votes
1 answer
123 views

Bit flipping attack in hash function for message authentication

In this picture we have a use of a hash function for message authentication. M is plaintext message. H is hash function. E is encryption block with K symmetric key. || is concatenation of plaintext M ...
Allexj's user avatar
  • 143
2 votes
0 answers
457 views

How to hash a JWT signature using Public & private key (Have both key in JSON format & X.509 PEM Format), using ES256 algo for JWT

I want to hash my signature of JWT using public & private key, since we are using ES-256 algorithm in JWT. But the problem is that I have both the keys in JSON & .PEM format, so how can I do ...
Amit Mishra's user avatar
1 vote
1 answer
2k views

best HMACSHA signed JWT secret length

I would like to use JWT but one thing I'm still thinking is ¿what is the best length for the secret? If I'm using HS512 as a signing method the secret should have a length of 512 bits as far as I ...
Clara Raquel's user avatar
1 vote
1 answer
89 views

LMS hash calls formula?

If we consider LMS with (SHA256 and LMS-OTS as the OTS scheme) as defined in sections 5 and 4 here: https://datatracker.ietf.org/doc/html/rfc8554#section-5, they provide the following formulas for LMS-...
destrand's user avatar
1 vote
1 answer
227 views

Code Singing Parameters for LMS/HSS/XMSS

LMS is specially used for applications, such as code-signing (https://csrc.nist.gov/CSRC/media/Publications/white-paper/2018/01/26/security-considerations-for-code-signing/final/documents/security-...
destrand's user avatar
3 votes
1 answer
1k views

What is "one-time signature"

I'm studying the post-quantum cryptography (PQC). While studying hash-based pqc, I read a thesis about Winternitz one-time signature scheme (W-OTS). What is the exact definition of "One-time ...
bjkim's user avatar
  • 31
2 votes
1 answer
90 views

FORS and DFORS Few time signature Security level

I was reading the FORS and DFORS Few-Time-Signature scheme. I understood the security of HORS Few time signature equals to $ (rk/t)^k $, but I could not understand the security of FORS is $ (r/t)^k $ ...
Alicia's user avatar
  • 23
0 votes
0 answers
95 views

Security proof of the Schnorr Signature

How Schnorr signature security can be proved for signature forgery, replacement, and Replay attacks?
SHI MA's user avatar
  • 1
2 votes
0 answers
34 views

If rabin signature uses a hash function then why cant we use that hash function to sign a message?

About Rabin Signature link According to this paper, the person who wants to sign a message M first appends a random byte string U. => M_new = MU Then uses a compression function to get c = ...
void_117's user avatar
2 votes
1 answer
142 views

How to prove that two hashes correspond to the same original message, without using the message to verify?

Let's suppose this: Message is "I love crypto.stackexchange.com" (M) Bob creates hash H1 with the message M and his private key (Priv) Alice receives a message X, and hash H2 with message X ...
JeremyDEX's user avatar
0 votes
1 answer
107 views

LMS signatures : Complexity of Classic Merkle Tree Traversal

I'm trying to understand the complexity of computing the Merkle root for stateful hash based signature schemes. Section 4.1 of the chapter on hash based signatures in "Post Quantum Cryptography&...
Rohit Khera's user avatar
0 votes
1 answer
216 views

Is it impossible to extract any data from an ECDSA signature of hashed data

I am trying to write a function that, given an EIP712 ECDSA signature, verifies the signature was signed by a particular person, and then (somehow) retrieves the information that is encoded in the ...
Barney Chambers's user avatar
0 votes
2 answers
95 views

Is there any way to claculate the hash of (a + b +c)) if you only know hash(a) and Hash(b) and Hash(c)?

For example, if you have say, 3 distinct paragraphs of clear text a, b, c and you only know hash(a), hash(b) and hash(c), and then you have a clear text d, which claims to be the concatenation of a, b,...
GGizmos's user avatar
  • 101
2 votes
1 answer
121 views

Lattice-based Signatures and Hashes

Although many different lattice-based signature schemes exist, Hash and Sign signatures schemes, like [GPV08], are prevalent. On the other hand, it is well known that collision-resistant hash ...
Carlos Ribeiro's user avatar
1 vote
1 answer
176 views

Comparing stateful hash-based signatures to group-based signatures

Some applications may require quick transition to post-quantum signatures, and stateful hash-based signatures fill that role (cf. CNSA 2.0). My question is (ignoring statefullness, focusing on space/...
yoyo's user avatar
  • 420
-1 votes
3 answers
572 views

Which of the following is a reason to publish files' hashes?

To valiate integrity or To verify if the software is digitally signed The question seems wrong to me. I do not see any reason to publish(make public) a hash. But it is in the material I am studying.
Abdulaziz's user avatar
2 votes
1 answer
206 views

Zk Proof to Prove that I know the secret x of y = HASH(x)

Lets say I know a secret value x. The hash of x, y = H(x) is public. Is there any zk way to ...
Zubayr's user avatar
  • 123
0 votes
2 answers
106 views

Is there any Cryptographic loop function that returns first input?

I want to use cryptographic function that returns the initial input or something related to it like its hash, the function should work like Encrypting some data or its hash, then encrypt the output of ...
Mohamed A. Taha's user avatar
1 vote
2 answers
103 views

Generalized Haircomb OTS vs Winternitz OTS at 256bit hash security level

Suppose a 256 bit hash is used (SHA2, SHA3, ...). How does the Winternitz OTS perform at various signature sizes? I'd want to compare to a generalized K-teeth Haircomb: It's signature is $K$ of these ...
Hugo Franklin's user avatar
-2 votes
1 answer
212 views

Why does the comb of Natasha Otomoski have 21 teeth? [closed]

What is the signature size of Natasha Otomoski haircomb? What is the number of invocations of the underlying one way hash function for key generation, signature, and verification? How does it compare ...
Hugo Franklin's user avatar
3 votes
1 answer
144 views

Alter SPHINCS+ to have collision probability=0 and remove entropy source when signing

If you alter the SPHINCS+ signature scheme such that the number of signatures it can sign is the same as the number of hashes the hashing algorithm can output such that for example if you have a 2^256 ...
Leanne K.'s user avatar
1 vote
1 answer
127 views

Stateful hash signature without Merkle trees

When it comes to stateful schemes, would you really need to use a Merkle tree? Couldn't you sign the hash of the message concatenated to the hash of the new public key? New public key: hash(hash(...
Lauren Fen.'s user avatar
0 votes
1 answer
82 views

How come we only need to generate the first tree in each layer in XMSS MT

From what I understand, to reduce the time taken for public key generation, you can use nested trees in XMSS to form Multi-tree XMSS. For an instantion of 2 layers, it seems that the leaf of each L ...
João Diogo Duarte's user avatar
0 votes
1 answer
1k views

Signing a hash of file vs signing a file

If person A generated a hash (e.g sha256) of a file and then signed the hash using a private key. Given person B only has the public key, file, signature and the hash, would verifying the signature ...
Simon C's user avatar
  • 109
1 vote
1 answer
81 views

A CERTIFIED DIGITAL SIGNATURE paper pg 20 - 25

Reference paper: "A CERTIFIED DIGITAL SIGNATURE" With reference to the image above which is from Page 20 of the attached paper. What is this new protocol that the paper speaks of here? What ...
redd's user avatar
  • 55
2 votes
1 answer
212 views

Questions on "A CERTIFIED DIGITAL SIGNATURE" Pg. 19

Referenced paper here. The above excerpt is from Page 19 of attached paper. I have a few questions. y = F^9(x) is equivalent of F(F(F(F(F(F(F(F(F(x))))))))) ? The excerpt says that this allows us to ...
redd's user avatar
  • 55