Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [hash-signature]

Hash-based digital signatures, such as Lamport one-time signatures, are digital signature schemes based on a (non-trapdoor) one-way function such as a cryptographic hash. Such schemes are expected to remain secure even against attacks using quantum computers.

1
vote
1answer
43 views

Forging RSA1024 signature with e=3 where hash is right justified

I am trying to understand (in the frame of exponent 3) how to calculate a "forgery" in the case where the desired result is: xxxxxxxxxxx[...]xxxxxxxxxxxxxxxxxxxxHHHHHHHHHHH[...]HHHHHHHH where HH = a ...
3
votes
0answers
23 views

Are there any hash-based multisignature schemes?

Are there any hash-based signature schemes which would let two (or more) people sign the same message without increasing the size of the signature linearly? For my purposes, it is fine if the scheme ...
0
votes
1answer
40 views

In W-OTS, could you XOR all public keys?

Since the signatures all generate the public keys, those can be derived from sig and proven by pre-commited XOR of every pub key compared with XOR of every signature end hash.
0
votes
1answer
27 views

In W-OTS, is it trivial to forge smaller N values?

Just read about W-OTS, since the signature is the private key hashed 256-N times, is it trivial to forge a signature with a smaller vale for N when having access to original signature? I.e. just hash ...
0
votes
0answers
27 views

Signature Generation with RSA PKCS#1 v.15

I am trying to validate my RSA implementation for digital signatures with the test vectors provided by NIST. For now, I am focusing on the tests for signature generation (SigGen15) with the PKCS#1 v....
0
votes
0answers
58 views

Proofs required to deem Homomorphic Hash-based Digital Signatures secure

I just discovered something amaze about homomorphic hashes. With them, we can build hash-based digital signatures so small, fast and without Merkle trees and sort of that. The question is which kind ...
2
votes
0answers
19 views

Strategies for fast integrity attestation over multi party computation for large messages

I am looking for ways to efficiently perform integrity attestation over large messages using multi party computation. While, hashing (SHA1, 256...) is one alternative but it's painfully slow and grows ...
1
vote
3answers
109 views

Digital Signature Algorithm for large files - bottle-necked by hash function?

I am new to studying digital signatures like ECDSA and EdDSA, and was curious about something. Lets say hypothetically I want to create a digital signatures of millions of files, with a total size of ...
3
votes
1answer
56 views

SPHINCS and HORST: can we sign the same message twice?

I was reading about SPHINCS which uses layers of WOTS+ trees and a bottom layer of HORST trees. HORST is a few time signature scheme, using a selection function you can sign at least twice without ...
0
votes
1answer
31 views

Basic question on hash-based signature scheme

If a hash-based signature schemes such as W-OTS is used, do we still need public key based certificates to prove ownership of a public key? I understand that hash-based signatures are one of the ...
1
vote
1answer
64 views

Digital signature

I learned that a digital signature is encrypted using private key and is decrypted using public key. How does the verifier gets the public for verifying the signature? If a person has to request ...
1
vote
1answer
330 views

What is the recommended minimum key length for ECDSA signature

I want to identify the proportion of certificates that use unrecommend ECDSA key length for TLS certificates based on some data I collected. By looking at a standard like NIST for example, I find ...
0
votes
1answer
108 views

Does RSASSAPSS use RSA signature

I just need to know is it correct to classify the RSASSAPSS scheme and sha[256 | 512 | 1]WithRSAEncryption all under RSA ...
1
vote
1answer
110 views

DSA signature generation [duplicate]

I am trying to implement given DSA signature generation instructions in python, there are few instructions that I couldn't understand in step 3 and 4. Let m be an arbitrary length message. The ...
0
votes
1answer
133 views

Use partial hash to verify entire hash

I've had an idea about storing parts of SHA256 hashes and I'd like to find out how secure it is, or how much less secure it is than storing the entire hash. For example, users can share this list of ...
1
vote
1answer
98 views

Does the One-Time Hash-based Signature Scheme render Ring Signatures useless?

On the Bitcoin community, to maintain privacy, they recommend using one-time spend addresses. CryptoNote, Monero et al. prefer Ring Signatures to maintain that privacy. There are some issues regarding ...
3
votes
1answer
35 views

For a hash over a finite space without size reduction, is a public permutation sufficient?

Suppose the application is a Lamport signature scheme. Is the following a secure hash $\{0,1\}^n \rightarrow \{0,1\}^n$? $$ H(x) = x \oplus P(x) $$ where $P$ is a public permutation that permutes an ...
1
vote
1answer
187 views

How does the user get the private/public key with HMAC based request signing?

I need to implement a HMAC signing of requests and I have read this article which explains the basics of what it is and how to achieve on theory. https://blog.andrewhoang.me/how-api-request-signing-...
1
vote
2answers
62 views

Why does WOTS+ need a checksum during signing operation?

I was reviewing WOTS+ scheme for consideration in our private blockchain, and noticed that it had a small overhead of calculating a checksum as seen in the following pseudocode excerpt from the ...
48
votes
11answers
14k views

How do hashes really ensure uniqueness?

This might seem an impractical and unnecessary conversation, but I feel it's something I need to clarify. Especially, as I just got my first developer job in a blockchain startup. So hashes are said ...
2
votes
2answers
87 views

Does the Server Key Exchange sign a hash or text

In TLS 1.2 when using ECDHE_RSA, the ServerKeyExchange message contains a signature over the server's ECDHE public parameters. My question is: Is the signature over ...
-2
votes
2answers
141 views

How to determine if a Hash function is preimage resistant?

So I'm trying to solve this problem. There are of course more but I'm trying to figure out how would I even solve this first one in order to do the rest. Any hints or help in the steps would be ...
0
votes
1answer
50 views

How many messages before Sphincs(+) becomes insecure?

How many messages would it take until the success probability of a forger becomes $1/2$? $1/4$?
0
votes
2answers
89 views

The use of Elliptic Curves as part of a blockchain transaction

As I understand it, Elliptic-Curve Cryptography is used in the verification step of a transaction (i.e. when creating a digital signature), but not in the creation and security of a 'block' (when ...
1
vote
1answer
46 views

Cryptographically secure hash function vulnerable to length extension attacks both to front and to back?

Is there any hash function where both $\text{hash}(m\|k)$ and $\text{hash}(k\|m)$ are vulnerable to length extension, but $\text{hash}(m)$ is itself secure?
-1
votes
1answer
43 views

I am new to digital certificate 509V3 concept. can some one please clarify the below points [closed]

I am using RSA 2048 with SHA 256 primitive in certificate: How to verify the user certificate n + 1 with Root certificate n? why it is required to perform Certificate chain verification? How to ...
1
vote
1answer
2k views

How can one validate with a public key a JWT signature generated with a private key?

As I understand it, a JSON Web Token (JWT) consists of 3 parts: the header, specifying the hashing algorithm to use for the signature; the payload itself; and the signature, which is a hash of the ...
0
votes
1answer
212 views

Why is SubtleCrypto API generating different signature for same data?

I am trying to generate key pairs using SubtleCrypto API in javascript and then using the same to sign some data using ECDSA algorithm. Documentation for the same can be found at this link. https://...
0
votes
1answer
125 views

Is it safe to hash a packet with a shared secret to prove authenticity?

I am developing an online game, where the server is written in Node.js and the client uses Godot. The issue is that Godot has no cryptographic functionalities (it can only encrypt and decrypt files, ...
2
votes
1answer
45 views

Why is WOTS-type signature schemes OTS?

I'm sure I've missed something super trivial, but why are WOTS-type schemes one-time? I've been looking into hash-based schemes, and I feel like I understand WOTS quite well (specifically I have ...
2
votes
0answers
87 views

Can this hash-based, short signature scheme work, given a decentralized log of messages as a primitive?

Suppose we had a decentralized log of messages, i.e., an ever-growing array of information on which anyone could append arbitrary data to. Given such primitive, could a party broadcast authenticated ...
0
votes
1answer
700 views

How is public key cryptography used for digital signature?

In public key cryptography, there are two different keys used for the encryption and decryption of data . I am wondering how it is used for digital signature
0
votes
1answer
40 views

Convert a state-dependent hash-based signature scheme into a stateless message-dependent one

Suppose we have an XMSSMT instance that is capable of signing up to 2^60 messages securely when given some state-dependent information, I could envision making it stateless as follow: Hash the ...
1
vote
1answer
96 views

Bitmasks or seed along with public key in WOTS+ post-quantum signatures

The state of the art hash-based post-quantum signature schemes, like Sphincs and XMSS, are using variations of WOTS (Winternitz OTS), like WOTS+, that require extra random bitmasks along with the ...
0
votes
2answers
142 views

Digital signatures with one-way function, can messages be longer than the signature?

Ethereum and Bitcoin both use 512 bit signatures, can the message that is being signed be longer than 512 bit?
1
vote
1answer
433 views

Does “hash than sign paradigm” apply to ECDSA cryptography?

From wikipedia https://en.wikipedia.org/wiki/Digital_signature#How_they_work and other articles I see that: "There are several reasons to sign such a hash (or message digest) instead of the whole ...
0
votes
1answer
292 views

eXtended Merkle Signature Scheme (XMSS) vs Leighton-Micali Signature (LMS)

Very briefly, how does eXtended Merkle Signature Scheme (XMSS) stack up against Leighton-Micali Signature (LMS)? I'm asking this in the context of my article here.
1
vote
1answer
367 views

What are the advantages and disadvantages of Merkle signatures over Lamport signatures?

I know they are both hash-based and post-quantum secure, and that Lamport signatures can form the basis for a Merkle scheme, but what do you actually gain over standard Lamport signatures by doing ...
2
votes
1answer
102 views

Smallest 256-bit security hash-based OTS?

What is the smallest hash-based OTS in terms of the sum of the public key and signature which provides 256 bits of security?
3
votes
1answer
272 views

How to use SPHINCS+?

Based on the NIST submission it looks like the SPHINCS+-256s algorithm comes in at public key sizes of 64 bytes, private key sizes of 128 bytes, and signature sizes ...
5
votes
1answer
495 views

Difference Between Gravity-SPHINCS and SPHINCS+?

What are the differences between Gravity-SPHINCS and SPHINCS+ from security and practicality standpoints? Are they just different implementations of the underlying SPHINCS algorithms or are they ...
0
votes
2answers
107 views

Reversability of Xor'd Values In Hash?

This may be a dumb question so please forgive me if so, but is a hash function considered one-way even if you have half of an xor'd value? For example say I have the values R and C, both are randomly ...
2
votes
2answers
156 views

Blind Hash Signatures?

Is it possible to implement blind signatures with purely hash-based signature algorithms? Any whitepapers, code samples, etc on the subject would be helpful.
3
votes
1answer
180 views

What is a formal definition of strong one-time-secure signatures?

What is a formal definition of strong one-time-secure signatures? I know the Lamport's scheme is one of them, but what is the global definition of it?
0
votes
1answer
58 views

Sequential delayed release of chained HMAC keys for use as asymmetric signature

Iterative hashing of a private random seed can yield keys for use in HMAC, which if revealed publicly in reverse order and on predetermined schedule, can be used in a manner similar to other ...
3
votes
1answer
744 views

Winternitz One time signature security

There are two versions of Winternitz-One time signature scheme, $W-OTS$ and $W-OTS^+$ Security of both is as following $W-OTS$ is strongly unforgeable under chosen message attacks if $F$ is a ...
4
votes
1answer
281 views

Is this Bleichenbacher '06 style signature forgery possible? (Or more like, why isn't it?)

I assume that most of you know this, but just for the sake of context; Bleichenbacher's signature forgery (https://www.ietf.org/mail-archive/web/openpgp/current/msg00999.html) basically abuses ...
2
votes
2answers
425 views

Winternitz hash based signature signing and verification

In Winternitz hash based signature There are two functions $f: \{0,1\}^n \to \{0,1 \}^n$, a one way function and $g: \{0,1\}^* \to \{0,1 \}^n$, cryptographic hash function Key Generation steps ...
1
vote
0answers
54 views

Rotatable hash-based duplicate check

I want to check duplicates of secret information which is also already encrypted in our database(using ECC algorithm, one of the std curves). plaintexts can be phone numbers, zip codes, etc. Since it'...
6
votes
1answer
805 views

What is the difference between signatures and VRF?

For example we have asymmetric signature scheme(RSA or ECC based) and VRF(also can be RSA/ECC based), both of them can be verified using public key of the signer/hasher and also are unique for each ...