Questions tagged [hash-signature]

Hash-based digital signatures, such as Lamport one-time signatures, are digital signature schemes based on a (non-trapdoor) one-way function such as a cryptographic hash. Such schemes are expected to remain secure even against attacks using quantum computers.

Filter by
Sorted by
Tagged with
2
votes
0answers
63 views

Is it more, or less, secure to use a different $F$ and $G$ for a Lamport signature?

A Lamport signature is made as follows: Alice stores $k_1, \cdots, k_{n'} \leftarrow K $ as her "private key", with one-way function $F: K\to V$, $n'>n$, and (easily enough) all $F(k_i)\...
0
votes
0answers
18 views

XMSS vs MSS (Motivation)

I was reading XMSS and I watched some of the presentations about it by Dr. Andreas Hülsing. But I cannot underdstand what is our motivation to use XMSS with 1 layer. Why is it better than MSS? I know ...
1
vote
1answer
111 views

How is ⊕ used in this paper?

In Lu, Au and Zhang's 2019 paper (Linkable) Ring Signature from Hash-Then-One-Way Signature, they …extend [M. Abe, M. Ohkubo, and K. Suzuki's 2019 1-out-of-n signatures from a variety of keys] ...
3
votes
1answer
86 views

Why are LMS and XMSS not candidates in the Post-Quantum Cryptography Standardization process?

Why are Leighton-Micali Signature Scheme (LMS) and eXtended Merkle Signature Scheme (XMSS) not candidates in the NIST Post-Quantum Cryptography Standardization process? Both are mentioned in the final ...
-2
votes
0answers
31 views

AES CBC Encryption Key & Special ASCII characters [duplicate]

Can we add characters like α π Σ µ ...
-1
votes
2answers
75 views

Special characters in AES Encryption Key

We all know that AES uses Key, IV and salt. But what if we add special ASCII characters like Alternate 255 (" ") or Alternatively 163 ("£") or Alternate 224 ("α") in the ...
1
vote
0answers
38 views

How to compare two post quantum digital signature schemes in terms of latency?

I want to compare two digital signature schemes of different nature. One is Hash-based (Winternitz one time signature scheme) and the other is lattice-based (Dilithium Crystals). What about be an ...
1
vote
0answers
33 views

How to evaluate number of security bits of a signature scheme?

I am trying to evaluate the effective security levels that a digital signature scheme (namely post-quantum digital schemes like WOT-S (Winternitz one time signature scheme) and Dilithium Crystals). ...
2
votes
0answers
37 views

How can one-way hash functions in the signatures help by using same algorithm for encryption and signature verification?

I read some documents about digital signatures and one way hash functions, etc., but everything was too complicated and I don't have much experience in cryptography. Can anyone explain to me in a ...
1
vote
0answers
48 views

How to prove that the given encryption scheme have ciphertext indistinguishability for all PPT adversaries?

I am not sure how to prove that the given two scheme is perfectly indistinguishable for all PPT adversaries!
0
votes
1answer
43 views

Leighton-Micali Hash-Based Signature key sizes

I am working with the RFC for Leighton-Micali Hash-Based Signatures: RFC-8554. The question is if I understood it correctly and my calculations of the key sizes are correct. Basically, LMS uses ...
1
vote
0answers
37 views

Implementing LMS

I already created my own version of the hash based signature scheme LMS, but my signing results do not match the test vectors provided in the RFC. I am not sure what I do wrong, thus I wanted to try ...
1
vote
1answer
69 views

How does TLS 1.3 work with PQC signatures?

I know that the first step in TLS 1.3 with modern signatures is hash the message with SHA256/SHA384/SHA512. Do PQC signatures work the same as modern algorithms in TLS 1.3?
2
votes
1answer
27 views

Using XMSS with Blake2

Since XMSS only requires a 2nd preimage resistant hash function, is using Blake2 in XMSS possible? It is not in standard, but Blake2 seems to be faster than SHA256
0
votes
0answers
53 views

Guarding against vulnerabilities for a digital signature service (RSA )

Lets's say I have a cipher-module / cryptography-service that signs a hash of some unknown payload. What are the possible attacks that I would need to guard against in this context (primarily assuming ...
0
votes
1answer
48 views

How secure is LMS?

LMS is a hash-based digital signature scheme. It is a standard alongside of XMSS, which has it's bit-security stated in the paper(about 200bit-security for standard parameters). LMS security ...
0
votes
0answers
28 views

What is the difference of having to use a ca.crt to verify a signed file vs the .crt used to sign it?

This seemed like the most appropriate place to ask this question so here it goes: I used to run a process that automatically generated a shim.key and ...
0
votes
1answer
27 views

What exactly is the purpose of the multi-tree variant in hash-based schemes?

In hash-based signature schemes that use Merkle trees (e.g. XMSS), what is exactly the purpose of the multi-tree variant? Seems like the same number of keys can be represented by a single larger tree? ...
0
votes
0answers
19 views

Performance comparison of SPHINCS+ and XMSS or LMS

Is there a comparison of the performance between SPHINCS+ and XMSS(MT) or LMS? I am aware of this paper that compares LMS and XMSS but nothing that compares either of them to SPHINCS+. I ask because I ...
1
vote
1answer
36 views

Why the LM-OTS signature is so long?

I refer to the LM-OTS specification in RFC8554. It seems that after having hashed all the chains, including the checksum’s ones, the signature is essentially the concatenation of the hash results. ...
0
votes
1answer
91 views

Does it make any sense to hash parts of a hashing target?

TL;DR; Assuming I'm calculating SHA256 for an ECDSA, does it make sense to do SHA256(item1 + SHA256(item1') + item2 + SHA256(item2') + itemN + SHA256(itemN')) or it'...
0
votes
1answer
101 views

Break El Gamal for Elliptic Curves

There is an elliptic curve El Gamal digital signature scheme. Alice fixes an elliptic curve $E$, a prime $p$, a point $A$ on $E$, a secret integer $a$, and computes $B = aA$. She makes $(E, ...
0
votes
1answer
34 views

Is there a difference in the security provided by a OTS vs a MTS or FTS? Or are they all just different ways of providing the same service?

Is there a difference in the security provided by a One Time signature vs a Many time Signature or a Few time signature? Or are they all just different ways of providing the same service?
2
votes
1answer
98 views

Is it possible to retrieve the original hash of a digital signature using a public key?

I am running a server that is receiving packets. Each packet is signed with an RSA 512 SHA-256 digital signature. I have a public key and exponent that I use to verify the digital signatures. I'm ...
1
vote
1answer
98 views

Can we use a Merkle Tree structure to reduce digest size?

A 2nd preimage attack is possible on the standard Merkle tree as pictured below. I'm aware that we can add identifiers (to differentiate nodes) to the input of each hash as discussed in the link. If ...
0
votes
1answer
211 views

What's the difference between these hash functions H, H1 and H2?

These are hash functions, but I don't understand their notations, can anyone tell me what's the difference between H, H1 and H2? $\mathbb{G}_1$ is an additive group and $\mathbb{G}_2$ is a ...
0
votes
0answers
31 views

Compare two protocols of keyed hash functions

Authentication protocol using a keyed hash function: Alice and Bob share a secret key for a keyed hash function. The protocol is: Alice $\Rightarrow$ $m||h_{k}(m)$ $\Rightarrow$ Bob. There are the ...
1
vote
0answers
19 views

How to optimize the parameters of extended merkle signature scheme? [closed]

Given the parameters which include: tree height, Winternitz parameter, security parameter, SHA-512 or SHA-256, tree level, how do I optimize the scheme to output a small signature? The idea is to ...
2
votes
1answer
123 views

Mapping the hash of message to a point of elliptic curve for signature

Let the subgroup $G$ of elliptic curve constructed with point $P$ with prime order $q$ by $G=\langle P\rangle $. The $h(x)$ is a hash function. We want to map the hash of arbitrary message $m$ to a ...
0
votes
1answer
70 views

generate a hash and validate if subset of string belong to that hash

I am trying to find if I can generate some encoded data from set of string and compare if the subset belong to that encoded data. Say ...
2
votes
0answers
71 views

Avoid storing the whole message when signing with SPHINCS+

Unlike pretty much every other signature scheme that I am aware of (excluding Picnic, the original SPHINCS, and SPHINCS-gravity) SPHINCS+ requires that the whole message be available during the ...
0
votes
1answer
100 views

Creating hash data signatures using RSA-CRT

I have taken two prime numbers p=137 q=131 M=64 and i want to create a digital signature ...
0
votes
1answer
59 views

How SPHINCS+ Hash Signature ADRS structure define

can anyone help me to elaborate the structure of ADRS with example ( tree ADRS, layer ADRS, keypair ADRS etc)used to generate root SPHINCS+ signature. Also can some one help me to describe tree hash ...
3
votes
1answer
46 views

How can a collision attack using MD5 be used to break WOTS

It is stated in Winternitz One time signature security that MD5 is not safe for Winternitz due to collision attack. Given that WOTS generates multiple, say 32 private keys then hashing them a number ...
3
votes
1answer
138 views

How does second pre-image attack on Merkle Signature Scheme work?

I understand that a second pre-image attack on the Merkle tree works by creating another Merkle tree using the intermediate nodes as the leaf nodes, and this will lead to the same root hash (public ...
0
votes
0answers
19 views

Digital signature from hashing encrypted webpage

I'm studying for the Security+ exam with the help of Total Seminars' Udemy course and in one video they claim that a digital signature is generated by encrypting a message with the sender's private ...
2
votes
1answer
103 views

Cryptographic function that can 'pack' numbers

Is there a cryptographic algorithm that can 'pack' a bunch of strings/numbers and "confirm" if a string/numbers exists (later in the code) while keeping the output hidden? For example, I have ...
1
vote
0answers
49 views

Exploiting weak hash functions in RSA-PSS

I'm just trying to understand how a Weak/broken hash can break RSA-PSS or any other signature/encryption that uses it. I know you can forge another message that has the same hash but that message ...
0
votes
1answer
50 views

Is Lamport OTS improved by using HMAC?

One problem with Lamport OTS is that the attacker can repeatedly try random inputs and there is a chance that a hash of a random input will match one of a large set of public keys, reducing the ...
1
vote
1answer
2k views

Understanding example of ECDSA P256

I am new to cryptography, I found the below Example on a nice website, but I am not able to understand the most of the terms used (H:Hash, K:Random number,E=?, Kinv=?,Rx=?=RY?,R=Private key?,D?,S? ...
2
votes
0answers
157 views

Using digital signature to reduce storage requirement

Below question is a part of my assignment and I was completely clueless about where to start from. So, I am posting it here for the purpose of getting hints/resources to help me get started. $ \ '' $...
1
vote
0answers
90 views

Best practice to hash multiple attributes

I have to generate a signature for concatenation of multiple independent values say A | B | C. Two options are : concatenate all attributes and generate the hash. Then Sign hash. $$ signature = Sign\...
1
vote
1answer
73 views

Simple: Hash Into a Prime Field

If I have some bytes, and I want to compute a secure hash into a prime field which is 300 bits long I can: Use a nice hash, like sha3_512, and then modulo my prime field (introduces some bias). ...
0
votes
1answer
84 views

Quantum Secure Signing Algorithm with a 256 bit signature & key. Am I missing anything? Can I remove tradeoff?

So I was looking at Lamport signatures and trying to figure out if there is a way to reduce the key size and signature. I stumbled across something that is tiny (125 times smaller signatures and 500 ...
3
votes
0answers
427 views

Are there any hash functions that are commutative yet secure for ordered lists?

I'm looking for a hashing function that can combine random numbers together in any order yet still find the same value. But it needs to be secure against hackers. The idea is if I'm hashing together: ...
1
vote
1answer
599 views

RSA Signing: SHA512 incompatible with PSS?

I am wrapping the RSACng class from the .Net API. Whilst unit testing, I run checks against an array of possibilities: Key Size = 1024, 2048, or 3072 bits Padding ...
0
votes
1answer
367 views

What is the public key and signature sizes for XMSS?

This is a follow-up to a recent question of mine. I am looking to find the public key and signature sizes for the XMSS signature scheme, in terms of the XMSS parameters (length $\ell$, height $h$ and ...
1
vote
1answer
158 views

XMSS^MT private key size

I'm doing some comparison on hash-based signature schemes. I am reading about one of the most recent schemes, XMSS^MT, and trying to figure out its actual public and private key sizes for concrete ...
10
votes
2answers
2k views

Advantages and disadvantages of hash-based signatures

We know hash-based signatures (Winternitz signature, HORS(T) signature) that are quantum-safe and efficient. They can be stateful or stateless, one-time or multiple-time. But why are they not widely ...
1
vote
0answers
50 views

Tuning the signature size of Sphincs+

If I only need a small number of signatures (perhaps $2^{10}$) for the lifetime of my key pair, how would I calculate the consequent signature size? Unfortunately managing state for an LMS or XMSS ...