Questions tagged [hash-signature]

Signature schemes built out of and based on properties of hash functions. **DO NOT USE THIS TAG** if the signature is based on other hard problems and just happen to employ a hash function.

Filter by
Sorted by
Tagged with
0 votes
1 answer
29 views

Comparing stateful hash-based signatures to group-based signatures

Some applications may require quick transition to post-quantum signatures, and stateful hash-based signatures fill that role (cf. CNSA 2.0). My question is (ignoring statefullness, focusing on space/...
  • 165
-1 votes
3 answers
202 views

Which of the following is a reason to publish files' hashes?

To valiate integrity or To verify if the software is digitally signed The question seems wrong to me. I do not see any reason to publish(make public) a hash. But it is in the material I am studying.
2 votes
1 answer
172 views

Zk Proof to Prove that I know the secret x of y = HASH(x)

Lets say I know a secret value x. The hash of x, y = H(x) is public. Is there any zk way to ...
  • 123
0 votes
2 answers
88 views

Is there any Cryptographic loop function that returns first input?

I want to use cryptographic function that returns the initial input or something related to it like its hash, the function should work like Encrypting some data or its hash, then encrypt the output of ...
1 vote
2 answers
49 views

Generalized Haircomb OTS vs Winternitz OTS at 256bit hash security level

Suppose a 256 bit hash is used (SHA2, SHA3, ...). How does the Winternitz OTS perform at various signature sizes? I'd want to compare to a generalized K-teeth Haircomb: It's signature is $K$ of these ...
-2 votes
1 answer
119 views

Why does the comb of Natasha Otomoski have 21 teeth? [closed]

What is the signature size of Natasha Otomoski haircomb? What is the number of invocations of the underlying one way hash function for key generation, signature, and verification? How does it compare ...
3 votes
1 answer
130 views

Alter SPHINCS+ to have collision probability=0 and remove entropy source when signing

If you alter the SPHINCS+ signature scheme such that the number of signatures it can sign is the same as the number of hashes the hashing algorithm can output such that for example if you have a 2^256 ...
1 vote
1 answer
96 views

Stateful hash signature without Merkle trees

When it comes to stateful schemes, would you really need to use a Merkle tree? Couldn't you sign the hash of the message concatenated to the hash of the new public key? New public key: hash(hash(...
0 votes
0 answers
15 views

Do L-trees remove the need of collision resistance hashes in XMSS MT?

I read that the bitmasks in XMSS-MT lower the security requirements from a collision resistant undetectable hash to a 2nd preimage resistant undetectable hash (see LMS vs XMSS: Comparion of two Hash-...
0 votes
1 answer
23 views

How come we only need to generate the first tree in each layer in XMSS MT

From what I understand, to reduce the time taken for public key generation, you can use nested trees in XMSS to form Multi-tree XMSS. For an instantion of 2 layers, it seems that the leaf of each L ...
0 votes
1 answer
116 views

Signing a hash of file vs signing a file

If person A generated a hash (e.g sha256) of a file and then signed the hash using a private key. Given person B only has the public key, file, signature and the hash, would verifying the signature ...
  • 109
1 vote
1 answer
76 views

A CERTIFIED DIGITAL SIGNATURE paper pg 20 - 25

Reference paper: "A CERTIFIED DIGITAL SIGNATURE" With reference to the image above which is from Page 20 of the attached paper. What is this new protocol that the paper speaks of here? What ...
  • 55
2 votes
1 answer
208 views

Questions on "A CERTIFIED DIGITAL SIGNATURE" Pg. 19

Referenced paper here. The above excerpt is from Page 19 of attached paper. I have a few questions. y = F^9(x) is equivalent of F(F(F(F(F(F(F(F(F(x))))))))) ? The excerpt says that this allows us to ...
  • 55
0 votes
0 answers
22 views

Why we need DSPR or Eq. 14 for the proof of SPHNICS+?

The paper says that We show that preimage resistance (PRE) follows tightly from the conjunction of second-preimage resistance (SPR) and decisional second-preimage resistance (DSPR). As I understand ...
  • 73
2 votes
1 answer
94 views

Lamport Diffie One-time Signature

I am going through the Lamport Diffie One-time signature. I am having a hard time understanding How can long messages (greater than 100 bits) can be mapped into short messages (100 bits) by a one way ...
  • 55
0 votes
0 answers
63 views

Is there a cryptography algorithm for signing values with two keys and requiring both to verify it?

Is there an algorithm that lets me sign a value with two keys at the same time, and in turn requires both keys to verify the signature? For instance, a scheme could work like this: Sign X with Key1 ...
  • 101
1 vote
0 answers
58 views

How to find strength of a cryptographic hash function?

I am having an idea to create a cryptographic hashing algorithm. I found a mathematical function $f: x \rightarrow y$ . By using Merkle-Damgård construction wide pipe, I designed a hashing function. ...
0 votes
1 answer
143 views

Why are WOTS and WOTS+ one-time schemes?

I've been doing some reading on hash based signature schemes, specifically XMSS and thus the underlying Winternitz scheme (WOTS+ to be precise). As their names suggests, WOTS and WOTS+ are one time ...
1 vote
1 answer
70 views

Why do we need both bitmasks and keyed hash in SPHINCS+

I think one of them is related to multitarget attacks and the other is related to collision attacks. But I cannot find how hash based crypto related to hash collisions. 1-) Consider the following ...
  • 73
2 votes
0 answers
54 views

Hash verification by key

I want to implement the following algorithm, but don't know what tools to use. D - data I generate some universal value for D - Y I generate some random key - K, get a hash of D by this key - H I ...
-1 votes
1 answer
138 views

Does sha256 is ok for that? If not does EC?

I think from what I studied that I had the correct reasoning, but I would like a double check. Here is the thing: Given two matrix: A and B I calculate the hashFunction(A, B) = C Now I calcultate the ...
1 vote
1 answer
148 views

What is the security strength of XMSS according to NIST PQC categories?

In the context of the NIST PQC standardization process, NIST has defined the following five security categories: Any attack that breaks the relevant security definition must require computational ...
  • 2,704
0 votes
0 answers
42 views

How does not tagging hashes result in leaking the secret key if a nonce is re-used in a different scheme?

I'm reading through BIP340 and I'm having trouble understanding this part: For example, without tagged hashing a BIP340 signature could also be valid for a signature scheme where the only difference ...
3 votes
1 answer
125 views

What hash based digital signature algorithms exist that have reasonably small signature sizes?

What hash based digital signature algorithms exist that have reasonably small signature sizes? By reasonably small, I mean not much bigger than what you would get with a 256-bit ECDSA (which I ...
  • 133
0 votes
0 answers
60 views

Decrypt one cipher with multiple and independent passwords

Consider that an online shop subscribes an embedded external service for their customers. This external webpage is accessible through a clickable banner on the online shop. On the subscription area of ...
  • 113
1 vote
1 answer
87 views

How is a keyImage linked to a ring signature?

I'm trying to understand the concept of ring signatures. So as it seems there is a way where you have a group of public keys which can be signed by only one private key of that group without revealing ...
4 votes
1 answer
310 views

Is $H(k || m) \oplus k$ secure?

It is known that $H(k || m)$ (when using SHA1) is an insecure MAC function since it is vulnerable to hash length extension. But what about $H(k || m) \oplus k$? A normal hash length extension seems to ...
1 vote
3 answers
121 views

Hash function collision importance

Suppose a collision has been found in a certain hash function, such that H(x1) = H(x2) However, x1 and x2 are both a seemingly 'random' collection of bits which do not convey a coherent message, and ...
  • 11
-2 votes
1 answer
52 views

Problem understanding the difference between passphrase and keyfiles

Ok, so I have read a few different articles on subject and am maybe just just having problems understanding the point of view from the program I am using or maybe not IDK. Anyhow, ill get into it. ...
10 votes
3 answers
5k views

Why is SHA3 more secure than SHA2?

Why are SHA3 algorithms considered more secure than their SHA2 counterparts? Surely in part, it is due to their resistance to length extension attacks. But specifically, when considering collision ...
0 votes
1 answer
53 views

Can we use symmetric/hashing functions to sign messsages as a quantum-proof replacement of public-private key signing?

Public-private key signing generally works like this: I announce my pubic key. I encrypt something with my private key. If people managed to decrypt (2) with (1) then (2) is from the owner of (1). ...
  • 529
0 votes
1 answer
72 views

How to do the WOTS checksum

As far as I understand, the Winternitz one-time signature is made by: Making an array of private keys. Making an array of public keys by hashing each private key X times, X being the number of ...
  • 3
0 votes
1 answer
137 views

How many valid signatures can the same message have using ElGamal?

I know that messages in ElGamal are not deterministic, so a message can have more than one valid signature. But is the number of valid subscriptions infinite?
  • 103
3 votes
1 answer
79 views

Making WOTS+ public keys shorter

In WOTS+ — as described in section 3 of RFC 8391 — public keys, private keys and signatures all consist of $len$ strings with $n$ bytes each, where $len, n \in \mathbb{N}$. Is it safe to use the hash ...
2 votes
1 answer
79 views

Are my calculations about WOTS parameters correct?

I'm reading the WOTS+ paper, but I'm having some trouble with its notation and specially the involved units. For example, under my interpretation, the parameters ...
  • 1,305
2 votes
1 answer
58 views

How do I construct the Fn family of functions of WOTS+ using SHA3?

From the WOTS+ paper: Furthermore, W-OTS+ uses a family of functions Fn : {f_k : {0, 1}^n → {0, 1}^n | k ∈ Kn} with key space Kn. The reader might think of it as a cryptographic hash function family ...
  • 1,305
3 votes
1 answer
134 views

Is NOTS a valid one time signature scheme?

I've just learn about NOTS, a quantum-resistant signature scheme based on hash functions that claims to have much shorter signature and key sizes. Is this signature scheme known to be secure? From ...
  • 1,305
0 votes
0 answers
44 views

Algorithm to validate 1 of N inputs is part of output hash

Is there an algorithm that allows proofing that an input x1 was used as 1 out of N inputs to create an output hash y, without ...
  • 101
0 votes
1 answer
89 views

Two Different Ciphers with Same MD5

I was wondering if someone could help explain md5 collision abit better. I found this resource: https://www.mscs.dal.ca/~selinger/md5collision/ where they provided an example of where two cipher texts ...
0 votes
1 answer
459 views

How secure is AES 256bitkey generated from PBKDF2

I am using CryptoJS AES 256 encryption: CryptoJS.AES.encrypt(realData, generateKey(passphrase), {iv: iv}); The secret is generated through: ...
1 vote
1 answer
88 views

What's the use of SHA on Non Digital Signature applications?

What's the use of SHA on Non Digital Signature applications? Why is SHA1 not a risk for Non Digital Signature applications? What's the difference between Non Digital Signature applications vs. Digital ...
1 vote
0 answers
58 views

Hashing Public Key of Lamport or Winternitz OTS

For the Lamport or Winternitz public keys, couldn't one just hash down the large public key to 256 bits in order to greatly reduce the public key size while still having basically the same security? ...
0 votes
0 answers
39 views

Is there a name for this simple identity verification scheme?

Once, while idly wondering, I came up with a simple scheme to prove the authenticity of a chain of messages given the authenticity of the first. It consists of putting a hash at the end of each ...
0 votes
2 answers
50 views

LMS Security Proof Paper

Is there any LMS security proof besides the one mentioned in RFC 8554? Does LMS actually have a paper which describes a proof?
0 votes
1 answer
39 views

XMSS MT for height 80

The XMSS RFC supports only tree heights of 60, which makes the chosen keypair to sign up to 2^60 messages, which is not practical for the use of SSL and so on. The paper https://eprint.iacr.org/2017/...
2 votes
0 answers
89 views

Is it more, or less, secure to use a different $F$ and $G$ for a Lamport signature?

A Lamport signature is made as follows: Alice stores $k_1, \cdots, k_{n'} \leftarrow K $ as her "private key", with one-way function $F: K\to V$, $n'>n$, and (easily enough) all $F(k_i)\...
1 vote
1 answer
176 views

What does $\text{PK}=\text{pk}\oplus\text{H}(\text{opk})$ represent in this paper?

In Lu, Au and Zhang's 2019 paper (Linkable) Ring Signature from Hash-Then-One-Way Signature, they …extend [M. Abe, M. Ohkubo, and K. Suzuki's 2019 1-out-of-n signatures from a variety of keys] ...
4 votes
1 answer
478 views

Why are LMS and XMSS not candidates in the Post-Quantum Cryptography Standardization process?

Why are Leighton-Micali Signature Scheme (LMS) and eXtended Merkle Signature Scheme (XMSS) not candidates in the NIST Post-Quantum Cryptography Standardization process? Both are mentioned in the final ...
  • 143
-2 votes
0 answers
35 views

AES CBC Encryption Key & Special ASCII characters [duplicate]

Can we add characters like α π Σ µ ...
  • 3
-1 votes
2 answers
3k views

Special characters in AES Encryption Key

We all know that AES uses Key, IV and salt. But what if we add special ASCII characters like Alternate 255 (" ") or Alternatively 163 ("£") or Alternate 224 ("α") in the ...
  • 3