Questions tagged [hash-signature]

Hash-based digital signatures, such as Lamport one-time signatures, are digital signature schemes based on a (non-trapdoor) one-way function such as a cryptographic hash. Such schemes are expected to remain secure even against attacks using quantum computers.

Filter by
Sorted by
Tagged with
3
votes
1answer
60 views

Making WOTS+ public keys shorter

In WOTS+ — as described in section 3 of RFC 8391 — public keys, private keys and signatures all consist of $len$ strings with $n$ bytes each, where $len, n \in \mathbb{N}$. Is it safe to use the hash ...
1
vote
1answer
38 views

Are my calculations about WOTS parameters correct?

I'm reading the WOTS+ paper, but I'm having some trouble with its notation and specially the involved units. For example, under my interpretation, the parameters ...
2
votes
1answer
41 views

How do I construct the Fn family of functions of WOTS+ using SHA3?

From the WOTS+ paper: Furthermore, W-OTS+ uses a family of functions Fn : {f_k : {0, 1}^n → {0, 1}^n | k ∈ Kn} with key space Kn. The reader might think of it as a cryptographic hash function family ...
3
votes
1answer
125 views

Is NOTS a valid one time signature scheme?

I've just learn about NOTS, a quantum-resistant signature scheme based on hash functions that claims to have much shorter signature and key sizes. Is this signature scheme known to be secure? From ...
0
votes
0answers
43 views

Algorithm to validate 1 of N inputs is part of output hash

Is there an algorithm that allows proofing that an input x1 was used as 1 out of N inputs to create an output hash y, without ...
0
votes
1answer
69 views

Two Different Ciphers with Same MD5

I was wondering if someone could help explain md5 collision abit better. I found this resource: https://www.mscs.dal.ca/~selinger/md5collision/ where they provided an example of where two cipher texts ...
0
votes
1answer
53 views

How secure is AES 256bitkey generated from PBKDF2

I am using CryptoJS AES 256 encryption: CryptoJS.AES.encrypt(realData, generateKey(passphrase), {iv: iv}); The secret is generated through: ...
0
votes
0answers
17 views

Can Merkle signatures be leveraged for key exchange?

A Merkle signature scheme is post-quantum-suitable as it relies only on the security of a one-way function. However, this construction seems to only be capable of authentication, and not ...
1
vote
1answer
29 views

What's the use of SHA on Non Digital Signature applications?

What's the use of SHA on Non Digital Signature applications? Why is SHA1 not a risk for Non Digital Signature applications? What's the difference between Non Digital Signature applications vs. Digital ...
1
vote
0answers
25 views

Hashing Public Key of Lamport or Winternitz OTS

For the Lamport or Winternitz public keys, couldn't one just hash down the large public key to 256 bits in order to greatly reduce the public key size while still having basically the same security? ...
0
votes
0answers
36 views

Is there a name for this simple identity verification scheme?

Once, while idly wondering, I came up with a simple scheme to prove the authenticity of a chain of messages given the authenticity of the first. It consists of putting a hash at the end of each ...
0
votes
2answers
36 views

LMS Security Proof Paper

Is there any LMS security proof besides the one mentioned in RFC 8554? Does LMS actually have a paper which describes a proof?
0
votes
1answer
33 views

XMSS MT for height 80

The XMSS RFC supports only tree heights of 60, which makes the chosen keypair to sign up to 2^60 messages, which is not practical for the use of SSL and so on. The paper https://eprint.iacr.org/2017/...
2
votes
0answers
77 views

Is it more, or less, secure to use a different $F$ and $G$ for a Lamport signature?

A Lamport signature is made as follows: Alice stores $k_1, \cdots, k_{n'} \leftarrow K $ as her "private key", with one-way function $F: K\to V$, $n'>n$, and (easily enough) all $F(k_i)\...
0
votes
0answers
22 views

XMSS vs MSS (Motivation)

I was reading XMSS and I watched some of the presentations about it by Dr. Andreas Hülsing. But I cannot underdstand what is our motivation to use XMSS with 1 layer. Why is it better than MSS? I know ...
1
vote
1answer
155 views

What does $\text{PK}=\text{pk}\oplus\text{H}(\text{opk})$ represent in this paper?

In Lu, Au and Zhang's 2019 paper (Linkable) Ring Signature from Hash-Then-One-Way Signature, they …extend [M. Abe, M. Ohkubo, and K. Suzuki's 2019 1-out-of-n signatures from a variety of keys] ...
3
votes
1answer
125 views

Why are LMS and XMSS not candidates in the Post-Quantum Cryptography Standardization process?

Why are Leighton-Micali Signature Scheme (LMS) and eXtended Merkle Signature Scheme (XMSS) not candidates in the NIST Post-Quantum Cryptography Standardization process? Both are mentioned in the final ...
-2
votes
0answers
32 views

AES CBC Encryption Key & Special ASCII characters [duplicate]

Can we add characters like α π Σ µ ...
-1
votes
2answers
257 views

Special characters in AES Encryption Key

We all know that AES uses Key, IV and salt. But what if we add special ASCII characters like Alternate 255 (" ") or Alternatively 163 ("£") or Alternate 224 ("α") in the ...
1
vote
0answers
49 views

How to compare two post quantum digital signature schemes in terms of latency?

I want to compare two digital signature schemes of different nature. One is Hash-based (Winternitz one time signature scheme) and the other is lattice-based (Dilithium Crystals). What about be an ...
1
vote
0answers
36 views

How to evaluate number of security bits of a signature scheme?

I am trying to evaluate the effective security levels that a digital signature scheme (namely post-quantum digital schemes like WOT-S (Winternitz one time signature scheme) and Dilithium Crystals). ...
2
votes
0answers
41 views

How can one-way hash functions in the signatures help by using same algorithm for encryption and signature verification?

I read some documents about digital signatures and one way hash functions, etc., but everything was too complicated and I don't have much experience in cryptography. Can anyone explain to me in a ...
1
vote
0answers
50 views

How to prove that the given encryption scheme have ciphertext indistinguishability for all PPT adversaries?

I am not sure how to prove that the given two scheme is perfectly indistinguishable for all PPT adversaries!
0
votes
1answer
51 views

Leighton-Micali Hash-Based Signature key sizes

I am working with the RFC for Leighton-Micali Hash-Based Signatures: RFC-8554. The question is if I understood it correctly and my calculations of the key sizes are correct. Basically, LMS uses ...
1
vote
0answers
42 views

Implementing LMS

I already created my own version of the hash based signature scheme LMS, but my signing results do not match the test vectors provided in the RFC. I am not sure what I do wrong, thus I wanted to try ...
1
vote
1answer
74 views

How does TLS 1.3 work with PQC signatures?

I know that the first step in TLS 1.3 with modern signatures is hash the message with SHA256/SHA384/SHA512. Do PQC signatures work the same as modern algorithms in TLS 1.3?
2
votes
1answer
31 views

Using XMSS with Blake2

Since XMSS only requires a 2nd preimage resistant hash function, is using Blake2 in XMSS possible? It is not in standard, but Blake2 seems to be faster than SHA256
0
votes
0answers
68 views

Guarding against vulnerabilities for a digital signature service (RSA )

Lets's say I have a cipher-module / cryptography-service that signs a hash of some unknown payload. What are the possible attacks that I would need to guard against in this context (primarily assuming ...
1
vote
1answer
59 views

How secure is LMS?

LMS is a hash-based digital signature scheme. It is a standard alongside of XMSS, which has it's bit-security stated in the paper(about 200bit-security for standard parameters). LMS security ...
0
votes
0answers
35 views

What is the difference of having to use a ca.crt to verify a signed file vs the .crt used to sign it?

This seemed like the most appropriate place to ask this question so here it goes: I used to run a process that automatically generated a shim.key and ...
0
votes
1answer
36 views

What exactly is the purpose of the multi-tree variant in hash-based schemes?

In hash-based signature schemes that use Merkle trees (e.g. XMSS), what is exactly the purpose of the multi-tree variant? Seems like the same number of keys can be represented by a single larger tree? ...
0
votes
0answers
31 views

Performance comparison of SPHINCS+ and XMSS or LMS

Is there a comparison of the performance between SPHINCS+ and XMSS(MT) or LMS? I am aware of this paper that compares LMS and XMSS but nothing that compares either of them to SPHINCS+. I ask because I ...
1
vote
1answer
44 views

Why the LM-OTS signature is so long?

I refer to the LM-OTS specification in RFC8554. It seems that after having hashed all the chains, including the checksum’s ones, the signature is essentially the concatenation of the hash results. ...
1
vote
1answer
110 views

Does it make any sense to hash parts of a hashing target?

TL;DR; Assuming I'm calculating SHA256 for an ECDSA, does it make sense to do SHA256(item1 + SHA256(item1') + item2 + SHA256(item2') + itemN + SHA256(itemN')) or it'...
0
votes
1answer
119 views

Break El Gamal for Elliptic Curves

There is an elliptic curve El Gamal digital signature scheme. Alice fixes an elliptic curve $E$, a prime $p$, a point $A$ on $E$, a secret integer $a$, and computes $B = aA$. She makes $(E, ...
0
votes
1answer
41 views

Is there a difference in the security provided by a OTS vs a MTS or FTS? Or are they all just different ways of providing the same service?

Is there a difference in the security provided by a One Time signature vs a Many time Signature or a Few time signature? Or are they all just different ways of providing the same service?
2
votes
1answer
164 views

Is it possible to retrieve the original hash of a digital signature using a public key?

I am running a server that is receiving packets. Each packet is signed with an RSA 512 SHA-256 digital signature. I have a public key and exponent that I use to verify the digital signatures. I'm ...
1
vote
1answer
106 views

Can we use a Merkle Tree structure to reduce digest size?

A 2nd preimage attack is possible on the standard Merkle tree as pictured below. I'm aware that we can add identifiers (to differentiate nodes) to the input of each hash as discussed in the link. If ...
0
votes
1answer
263 views

What's the difference between these hash functions H, H1 and H2?

These are hash functions, but I don't understand their notations, can anyone tell me what's the difference between H, H1 and H2? $\mathbb{G}_1$ is an additive group and $\mathbb{G}_2$ is a ...
0
votes
0answers
37 views

Compare two protocols of keyed hash functions

Authentication protocol using a keyed hash function: Alice and Bob share a secret key for a keyed hash function. The protocol is: Alice $\Rightarrow$ $m||h_{k}(m)$ $\Rightarrow$ Bob. There are the ...
1
vote
0answers
21 views

How to optimize the parameters of extended merkle signature scheme? [closed]

Given the parameters which include: tree height, Winternitz parameter, security parameter, SHA-512 or SHA-256, tree level, how do I optimize the scheme to output a small signature? The idea is to ...
2
votes
1answer
139 views

Mapping the hash of message to a point of elliptic curve for signature

Let the subgroup $G$ of elliptic curve constructed with point $P$ with prime order $q$ by $G=\langle P\rangle $. The $h(x)$ is a hash function. We want to map the hash of arbitrary message $m$ to a ...
2
votes
0answers
75 views

Avoid storing the whole message when signing with SPHINCS+

Unlike pretty much every other signature scheme that I am aware of (excluding Picnic, the original SPHINCS, and SPHINCS-gravity) SPHINCS+ requires that the whole message be available during the ...
0
votes
1answer
116 views

Creating hash data signatures using RSA-CRT

I have taken two prime numbers p=137 q=131 M=64 and i want to create a digital signature ...
0
votes
1answer
60 views

How SPHINCS+ Hash Signature ADRS structure define

can anyone help me to elaborate the structure of ADRS with example ( tree ADRS, layer ADRS, keypair ADRS etc)used to generate root SPHINCS+ signature. Also can some one help me to describe tree hash ...
3
votes
1answer
51 views

How can a collision attack using MD5 be used to break WOTS

It is stated in Winternitz One time signature security that MD5 is not safe for Winternitz due to collision attack. Given that WOTS generates multiple, say 32 private keys then hashing them a number ...
3
votes
1answer
167 views

How does second pre-image attack on Merkle Signature Scheme work?

I understand that a second pre-image attack on the Merkle tree works by creating another Merkle tree using the intermediate nodes as the leaf nodes, and this will lead to the same root hash (public ...
2
votes
1answer
104 views

Cryptographic function that can 'pack' numbers

Is there a cryptographic algorithm that can 'pack' a bunch of strings/numbers and "confirm" if a string/numbers exists (later in the code) while keeping the output hidden? For example, I have ...
1
vote
0answers
57 views

Exploiting weak hash functions in RSA-PSS

I'm just trying to understand how a Weak/broken hash can break RSA-PSS or any other signature/encryption that uses it. I know you can forge another message that has the same hash but that message ...
0
votes
1answer
62 views

Is Lamport OTS improved by using HMAC?

One problem with Lamport OTS is that the attacker can repeatedly try random inputs and there is a chance that a hash of a random input will match one of a large set of public keys, reducing the ...