Questions tagged [hash-signature]
Signature schemes built out of and based on properties of hash functions. **DO NOT USE THIS TAG** if the signature is based on other hard problems and just happen to employ a hash function.
169
questions
0
votes
1
answer
62
views
How does FORS: Forest of Random Subsets work?
I saw a post named "How does signing with FORS work in SPHINCS+?" but in the post it seems like no one had explain how does the FORS works.
SK: Secret Key, PRF: Pseudo-Random Function
I'm ...
0
votes
0
answers
28
views
Is hashing really enough for data integrity or needs signing? [duplicate]
Hashing functions are used for data integrity when integrated with signing asymmetric algorithms but I miss a step. In multiple sources like here or here I read for granted that hashing algorithm per ...
- 129
0
votes
1
answer
39
views
What are the statefulness and signature count limits of SPHINCS+?
SPHINCS+ is an interesting post-quantum algorithm, and I'm curious about what its limitations are. What I know about hash-based signature formats in the past are that you needed to remember which ...
- 2,513
1
vote
2
answers
1k
views
Why is SHA256 used as a layer on top of Digital Signature [duplicate]
Digital Signatures use an asymmetric algorithm, meaning that if I want to apply a digital signature to a document I sign it with my own private key and send it to the recipient.
The recipient, thanks ...
- 129
1
vote
1
answer
156
views
Cryptography to tackle deepfake, proving the photo is original
Deepfake technology has become very difficult to tackle due to sophisticated machine learning algorithms. Now, even when a journalist or bystander provides photo or video evidence, the culprit denies ...
- 111
0
votes
1
answer
101
views
NIST PQC: minimum number of digital signatures
I've been checking the NIST PQC documents to find the requirements about the minimum required numbers of signatures to be generated with a signature scheme:
NIST call for proposals
Call for ...
- 101
0
votes
2
answers
375
views
Best cryptographic method to distribute license files
I will describe my problem high-level, and not ask a very specific cryptographic question, since I am open for general suggestions as well. So in my question I will only speak about "security ...
- 111
1
vote
0
answers
18
views
Curious behavior of EVP_DigestSign for DKIM
Difficulties porting code to OpenSSL 3 may raise some doubts on digest signing. Before version 3 came, digest signing was the only way to use ED25519. On version 3, RSA_sign() being deprecated, I ...
- 111
1
vote
1
answer
55
views
What happens when a Merkle Tree OTS scheme runs out of keys
A Merkle Tree OTS scheme such as XMSS pregenerates 2^h keys that are tied to 1 public key
When the 2^h keys run out, does all the 2^h keys get removed/deleted and the device pregenerates another new 2^...
- 13
1
vote
1
answer
48
views
Regarding the Digital Signature Algorithm During Client Authentication in TLS 1.2
In TLS 1.2, when client authentication is carried out, digital signatures are utilized. However, at what point is the specific signature algorithm communicated to the server? It seems to me that the ...
- 11
0
votes
1
answer
49
views
Can I verify a message with Openssl if it was sign with .Net System.Security.Cryptography?
Sorry, this is sort of a beginner question.
But providing that it is possible to find the same options, can I verify a message with Openssl if it was sign with .Net System.Security.Cryptography ?
Let'...
- 103
1
vote
1
answer
41
views
PRNG to Obtain Random Subset (PORS) Success Probability
PORS (PRNG to ORS) is a secure variant of the HORS few-time signature scheme. In PORS, instead of using a hash function, it uses a message (and salt) as a seed of PRNG and query it until obtains k ...
- 11
1
vote
1
answer
107
views
Post-quantum EU-CMA security from OWF-only
In the paper: "Universal One-Way Hash Functions and their Cryptographic
Applications". The following is proven: "If 1-1 one-way functions exist, then the one-way based signature scheme ...
- 223
2
votes
1
answer
71
views
Bit flipping attack in hash function for message authentication
In this picture we have a use of a hash function for message authentication.
M is plaintext message. H is hash function. E is encryption block with K symmetric key. || is concatenation of plaintext M ...
- 139
2
votes
0
answers
335
views
How to hash a JWT signature using Public & private key (Have both key in JSON format & X.509 PEM Format), using ES256 algo for JWT
I want to hash my signature of JWT using public & private key, since we are using ES-256 algorithm in JWT. But the problem is that I have both the keys in JSON & .PEM format, so how can I do ...
- 21
1
vote
1
answer
425
views
best HMACSHA signed JWT secret length
I would like to use JWT but one thing I'm still thinking is ¿what is the best length for the secret?
If I'm using HS512 as a signing method the secret should have a length of 512 bits as far as I ...
- 13
1
vote
1
answer
42
views
LMS hash calls formula?
If we consider LMS with (SHA256 and LMS-OTS as the OTS scheme) as defined in sections 5 and 4 here:
https://datatracker.ietf.org/doc/html/rfc8554#section-5, they provide the following formulas for LMS-...
- 21
1
vote
1
answer
151
views
Code Singing Parameters for LMS/HSS/XMSS
LMS is specially used for applications, such as code-signing (https://csrc.nist.gov/CSRC/media/Publications/white-paper/2018/01/26/security-considerations-for-code-signing/final/documents/security-...
- 21
3
votes
1
answer
618
views
What is "one-time signature"
I'm studying the post-quantum cryptography (PQC).
While studying hash-based pqc, I read a thesis about Winternitz one-time signature scheme (W-OTS). What is the exact definition of "One-time ...
- 31
2
votes
1
answer
72
views
FORS and DFORS Few time signature Security level
I was reading the FORS and DFORS Few-Time-Signature scheme. I understood the security of HORS Few time signature equals to $ (rk/t)^k $, but I could not understand the security of FORS is $ (r/t)^k $ ...
- 23
0
votes
0
answers
74
views
Security proof of the Schnorr Signature
How Schnorr signature security can be proved for signature forgery, replacement, and Replay attacks?
- 1
2
votes
0
answers
33
views
If rabin signature uses a hash function then why cant we use that hash function to sign a message?
About Rabin Signature link
According to this paper, the person who wants to sign a message M first appends a random byte string U.
=> M_new = MU
Then uses a compression function to get c = ...
- 21
2
votes
1
answer
137
views
How to prove that two hashes correspond to the same original message, without using the message to verify?
Let's suppose this:
Message is "I love crypto.stackexchange.com" (M)
Bob creates hash H1 with the message M and his private key (Priv)
Alice receives a message X, and hash H2 with message X ...
- 51
0
votes
1
answer
74
views
LMS signatures : Complexity of Classic Merkle Tree Traversal
I'm trying to understand the complexity of computing the Merkle root for stateful hash based signature schemes. Section 4.1 of the chapter on hash based signatures in "Post Quantum Cryptography&...
- 678
0
votes
1
answer
157
views
Is it impossible to extract any data from an ECDSA signature of hashed data
I am trying to write a function that, given an EIP712 ECDSA signature, verifies the signature was signed by a particular person, and then (somehow) retrieves the information that is encoded in the ...
- 103
0
votes
2
answers
92
views
Is there any way to claculate the hash of (a + b +c)) if you only know hash(a) and Hash(b) and Hash(c)?
For example, if you have say, 3 distinct paragraphs of clear text a, b, c and you only know hash(a), hash(b) and hash(c), and then you have a clear text d, which claims to be the concatenation of a, b,...
- 101
2
votes
1
answer
90
views
Lattice-based Signatures and Hashes
Although many different lattice-based signature schemes exist, Hash and Sign signatures schemes, like [GPV08], are prevalent. On the other hand, it is well known that collision-resistant hash ...
1
vote
1
answer
127
views
Comparing stateful hash-based signatures to group-based signatures
Some applications may require quick transition to post-quantum signatures, and stateful hash-based signatures fill that role (cf. CNSA 2.0).
My question is (ignoring statefullness, focusing on space/...
- 367
-1
votes
3
answers
505
views
Which of the following is a reason to publish files' hashes?
To valiate integrity
or
To verify if the software is digitally signed
The question seems wrong to me. I do not see any reason to publish(make public) a hash. But it is in the material I am studying.
2
votes
1
answer
190
views
Zk Proof to Prove that I know the secret x of y = HASH(x)
Lets say I know a secret value x.
The hash of x, y = H(x) is public.
Is there any zk way to ...
- 123
0
votes
2
answers
100
views
Is there any Cryptographic loop function that returns first input?
I want to use cryptographic function that returns the initial input or something related to it like its hash, the function should work like Encrypting some data or its hash, then encrypt the output of ...
1
vote
2
answers
92
views
Generalized Haircomb OTS vs Winternitz OTS at 256bit hash security level
Suppose a 256 bit hash is used (SHA2, SHA3, ...).
How does the Winternitz OTS perform at various signature sizes?
I'd want to compare to a generalized K-teeth Haircomb:
It's signature is $K$ of these ...
-2
votes
1
answer
197
views
Why does the comb of Natasha Otomoski have 21 teeth? [closed]
What is the signature size of Natasha Otomoski haircomb? What is the number of invocations of the underlying one way hash function for key generation, signature, and verification?
How does it compare ...
3
votes
1
answer
141
views
Alter SPHINCS+ to have collision probability=0 and remove entropy source when signing
If you alter the SPHINCS+ signature scheme such that the number of signatures it can sign is the same as the number of hashes the hashing algorithm can output such that for example if you have a 2^256 ...
- 31
1
vote
1
answer
121
views
Stateful hash signature without Merkle trees
When it comes to stateful schemes, would you really need to use a Merkle tree?
Couldn't you sign the hash of the message concatenated to the hash of the new public key?
New public key: hash(hash(...
- 33
0
votes
1
answer
61
views
How come we only need to generate the first tree in each layer in XMSS MT
From what I understand, to reduce the time taken for public key generation, you can use nested trees in XMSS to form Multi-tree XMSS.
For an instantion of 2 layers, it seems that the leaf of each L ...
- 25
0
votes
1
answer
627
views
Signing a hash of file vs signing a file
If person A generated a hash (e.g sha256) of a file and then signed the hash using a private key.
Given person B only has the public key, file, signature and the hash, would verifying the signature ...
- 109
1
vote
1
answer
79
views
A CERTIFIED DIGITAL SIGNATURE paper pg 20 - 25
Reference paper: "A CERTIFIED DIGITAL SIGNATURE"
With reference to the image above which is from Page 20 of the attached paper. What is this new protocol that the paper speaks of here? What ...
- 55
2
votes
1
answer
209
views
Questions on "A CERTIFIED DIGITAL SIGNATURE" Pg. 19
Referenced paper here.
The above excerpt is from Page 19 of attached paper. I have a few questions.
y = F^9(x) is equivalent of F(F(F(F(F(F(F(F(F(x))))))))) ?
The excerpt says that this allows us to ...
- 55
2
votes
1
answer
276
views
Lamport Diffie One-time Signature
I am going through the Lamport Diffie One-time signature. I am having a hard time understanding
How can long messages (greater than 100 bits) can be mapped into short messages (100 bits) by a one way ...
- 55
0
votes
0
answers
116
views
Is there a cryptography algorithm for signing values with two keys and requiring both to verify it?
Is there an algorithm that lets me sign a value with two keys at the same time, and in turn requires both keys to verify the signature?
For instance, a scheme could work like this:
Sign X with Key1 ...
- 101
1
vote
0
answers
93
views
How to find strength of a cryptographic hash function?
I am having an idea to create a cryptographic hashing algorithm. I found a mathematical function $f: x \rightarrow y$ . By using Merkle-Damgård construction wide pipe, I designed a hashing function. ...
1
vote
1
answer
539
views
Why are WOTS and WOTS+ one-time schemes?
I've been doing some reading on hash based signature schemes, specifically XMSS and thus the underlying Winternitz scheme (WOTS+ to be precise).
As their names suggests, WOTS and WOTS+ are one time ...
- 13
1
vote
1
answer
134
views
Why do we need both bitmasks and keyed hash in SPHINCS+
I think one of them is related to multitarget attacks and the other is related to collision attacks. But I cannot find how hash based crypto related to hash collisions.
1-) Consider the following ...
- 153
2
votes
0
answers
74
views
Hash verification by key
I want to implement the following algorithm, but don't know what tools to use.
D - data
I generate some universal value for D - Y
I generate some random key - K, get a hash of D by this key - H
I ...
- 21
-1
votes
1
answer
143
views
Does sha256 is ok for that? If not does EC?
I think from what I studied that I had the correct reasoning, but I would like a double check. Here is the thing:
Given two matrix: A and B
I calculate the hashFunction(A, B) = C
Now I calcultate the ...
- 119
2
votes
1
answer
420
views
What is the security strength of XMSS according to NIST PQC categories?
In the context of the NIST PQC standardization process, NIST has defined the following five security categories:
Any attack that breaks the relevant security definition must require computational ...
- 2,826
3
votes
1
answer
174
views
What hash based digital signature algorithms exist that have reasonably small signature sizes?
What hash based digital signature algorithms exist that have reasonably small signature sizes?
By reasonably small, I mean not much bigger than what you would get with a 256-bit ECDSA (which I ...
- 131
0
votes
0
answers
64
views
Decrypt one cipher with multiple and independent passwords
Consider that an online shop subscribes an embedded external service for their customers. This external webpage is accessible through a clickable banner on the online shop.
On the subscription area of ...
- 113
1
vote
1
answer
133
views
How is a keyImage linked to a ring signature?
I'm trying to understand the concept of ring signatures. So as it seems there is a way where you have a group of public keys which can be signed by only one private key of that group without revealing ...
- 113