Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [hash-signature]

Hash-based digital signatures, such as Lamport one-time signatures, are digital signature schemes based on a (non-trapdoor) one-way function such as a cryptographic hash. Such schemes are expected to remain secure even against attacks using quantum computers.

1
vote
1answer
35 views

Signing a message using SPHINCS Hash-based Signature scheme

I have questions on “SPHINCS: practical stateless has-based signature” by Bernstein et al. And I really hope that someone can help me with it. To help me understand it, I read the https://...
0
votes
0answers
26 views

Accessing Firefox key store for signing [on hold]

Is there any way we can digitally sign the transaction in a web app by using the certificate stored at Firefox's key store.
1
vote
0answers
21 views

How does the KeyGen of Merkle's improvement of Lamport's OTS work?

In his paper [1] on page 17 and 18, Merkle proposes an improvement on Lamport's OTS by only signing the 1's in the message in combination with a checksum of the amount of 0's in the message. I get the ...
1
vote
0answers
28 views

short signature for EC

i'm building a low-power wireless sensor network in which each slave node has a public/private ECC key pair -- generated by the node itself during manufacturing.... the slave node is also provisioned ...
0
votes
0answers
21 views

Security implications of an extra inner encrypt for a single block Matyas-Meyer-Oseas hash function

Was giving some thought to simple MMO constructions for fast single block hash functions for things like PQ crypto. There's Haraka, but that's not standard and readily available while simple AES is in ...
1
vote
1answer
50 views

Forging RSA1024 signature with e=3 where hash is right justified

I am trying to understand (in the frame of exponent 3) how to calculate a "forgery" in the case where the desired result is: xxxxxxxxxxx[...]xxxxxxxxxxxxxxxxxxxxHHHHHHHHHHH[...]HHHHHHHH where HH = a ...
3
votes
0answers
27 views

Are there any hash-based multisignature schemes?

Are there any hash-based signature schemes which would let two (or more) people sign the same message without increasing the size of the signature linearly? For my purposes, it is fine if the scheme ...
0
votes
1answer
44 views

In W-OTS, could you XOR all public keys?

Since the signatures all generate the public keys, those can be derived from sig and proven by pre-commited XOR of every pub key compared with XOR of every signature end hash.
0
votes
1answer
39 views

In W-OTS, is it trivial to forge smaller N values?

Just read about W-OTS, since the signature is the private key hashed 256-N times, is it trivial to forge a signature with a smaller vale for N when having access to original signature? I.e. just hash ...
0
votes
0answers
42 views

Signature Generation with RSA PKCS#1 v.15

I am trying to validate my RSA implementation for digital signatures with the test vectors provided by NIST. For now, I am focusing on the tests for signature generation (SigGen15) with the PKCS#1 v....
2
votes
0answers
20 views

Strategies for fast integrity attestation over multi party computation for large messages

I am looking for ways to efficiently perform integrity attestation over large messages using multi party computation. While, hashing (SHA1, 256...) is one alternative but it's painfully slow and grows ...
1
vote
3answers
113 views

Digital Signature Algorithm for large files - bottle-necked by hash function?

I am new to studying digital signatures like ECDSA and EdDSA, and was curious about something. Lets say hypothetically I want to create a digital signatures of millions of files, with a total size of ...
3
votes
1answer
62 views

SPHINCS and HORST: can we sign the same message twice?

I was reading about SPHINCS which uses layers of WOTS+ trees and a bottom layer of HORST trees. HORST is a few time signature scheme, using a selection function you can sign at least twice without ...
0
votes
1answer
34 views

Basic question on hash-based signature scheme

If a hash-based signature schemes such as W-OTS is used, do we still need public key based certificates to prove ownership of a public key? I understand that hash-based signatures are one of the ...
1
vote
1answer
66 views

Digital signature

I learned that a digital signature is encrypted using private key and is decrypted using public key. How does the verifier gets the public for verifying the signature? If a person has to request ...
1
vote
1answer
443 views

What is the recommended minimum key length for ECDSA signature

I want to identify the proportion of certificates that use unrecommend ECDSA key length for TLS certificates based on some data I collected. By looking at a standard like NIST for example, I find ...
0
votes
1answer
142 views

Does RSASSAPSS use RSA signature

I just need to know is it correct to classify the RSASSAPSS scheme and sha[256 | 512 | 1]WithRSAEncryption all under RSA ...
1
vote
1answer
127 views

DSA signature generation [duplicate]

I am trying to implement given DSA signature generation instructions in python, there are few instructions that I couldn't understand in step 3 and 4. Let m be an arbitrary length message. The ...
0
votes
1answer
168 views

Use partial hash to verify entire hash

I've had an idea about storing parts of SHA256 hashes and I'd like to find out how secure it is, or how much less secure it is than storing the entire hash. For example, users can share this list of ...
1
vote
1answer
103 views

Does the One-Time Hash-based Signature Scheme render Ring Signatures useless?

On the Bitcoin community, to maintain privacy, they recommend using one-time spend addresses. CryptoNote, Monero et al. prefer Ring Signatures to maintain that privacy. There are some issues regarding ...
3
votes
1answer
36 views

For a hash over a finite space without size reduction, is a public permutation sufficient?

Suppose the application is a Lamport signature scheme. Is the following a secure hash $\{0,1\}^n \rightarrow \{0,1\}^n$? $$ H(x) = x \oplus P(x) $$ where $P$ is a public permutation that permutes an ...
1
vote
1answer
219 views

How does the user get the private/public key with HMAC based request signing?

I need to implement a HMAC signing of requests and I have read this article which explains the basics of what it is and how to achieve on theory. https://blog.andrewhoang.me/how-api-request-signing-...
1
vote
2answers
78 views

Why does WOTS+ need a checksum during signing operation?

I was reviewing WOTS+ scheme for consideration in our private blockchain, and noticed that it had a small overhead of calculating a checksum as seen in the following pseudocode excerpt from the ...
48
votes
11answers
15k views

How do hashes really ensure uniqueness?

This might seem an impractical and unnecessary conversation, but I feel it's something I need to clarify. Especially, as I just got my first developer job in a blockchain startup. So hashes are said ...
2
votes
2answers
99 views

Does the Server Key Exchange sign a hash or text

In TLS 1.2 when using ECDHE_RSA, the ServerKeyExchange message contains a signature over the server's ECDHE public parameters. My question is: Is the signature over ...
-2
votes
2answers
155 views

How to determine if a Hash function is preimage resistant?

So I'm trying to solve this problem. There are of course more but I'm trying to figure out how would I even solve this first one in order to do the rest. Any hints or help in the steps would be ...
0
votes
1answer
54 views

How many messages before Sphincs(+) becomes insecure?

How many messages would it take until the success probability of a forger becomes $1/2$? $1/4$?
0
votes
2answers
89 views

The use of Elliptic Curves as part of a blockchain transaction

As I understand it, Elliptic-Curve Cryptography is used in the verification step of a transaction (i.e. when creating a digital signature), but not in the creation and security of a 'block' (when ...
1
vote
1answer
47 views

Cryptographically secure hash function vulnerable to length extension attacks both to front and to back?

Is there any hash function where both $\text{hash}(m\|k)$ and $\text{hash}(k\|m)$ are vulnerable to length extension, but $\text{hash}(m)$ is itself secure?
-1
votes
1answer
43 views

I am new to digital certificate 509V3 concept. can some one please clarify the below points [closed]

I am using RSA 2048 with SHA 256 primitive in certificate: How to verify the user certificate n + 1 with Root certificate n? why it is required to perform Certificate chain verification? How to ...
2
votes
1answer
2k views

How can one validate with a public key a JWT signature generated with a private key?

As I understand it, a JSON Web Token (JWT) consists of 3 parts: the header, specifying the hashing algorithm to use for the signature; the payload itself; and the signature, which is a hash of the ...
0
votes
1answer
224 views

Why is SubtleCrypto API generating different signature for same data?

I am trying to generate key pairs using SubtleCrypto API in javascript and then using the same to sign some data using ECDSA algorithm. Documentation for the same can be found at this link. https://...
0
votes
1answer
140 views

Is it safe to hash a packet with a shared secret to prove authenticity?

I am developing an online game, where the server is written in Node.js and the client uses Godot. The issue is that Godot has no cryptographic functionalities (it can only encrypt and decrypt files, ...
2
votes
1answer
56 views

Why is WOTS-type signature schemes OTS?

I'm sure I've missed something super trivial, but why are WOTS-type schemes one-time? I've been looking into hash-based schemes, and I feel like I understand WOTS quite well (specifically I have ...
2
votes
0answers
100 views

Can this hash-based, short signature scheme work, given a decentralized log of messages as a primitive?

Suppose we had a decentralized log of messages, i.e., an ever-growing array of information on which anyone could append arbitrary data to. Given such primitive, could a party broadcast authenticated ...
0
votes
1answer
749 views

How is public key cryptography used for digital signature?

In public key cryptography, there are two different keys used for the encryption and decryption of data . I am wondering how it is used for digital signature
0
votes
1answer
41 views

Convert a state-dependent hash-based signature scheme into a stateless message-dependent one

Suppose we have an XMSSMT instance that is capable of signing up to 2^60 messages securely when given some state-dependent information, I could envision making it stateless as follow: Hash the ...
1
vote
1answer
97 views

Bitmasks or seed along with public key in WOTS+ post-quantum signatures

The state of the art hash-based post-quantum signature schemes, like Sphincs and XMSS, are using variations of WOTS (Winternitz OTS), like WOTS+, that require extra random bitmasks along with the ...
0
votes
2answers
151 views

Digital signatures with one-way function, can messages be longer than the signature?

Ethereum and Bitcoin both use 512 bit signatures, can the message that is being signed be longer than 512 bit?
1
vote
1answer
469 views

Does “hash than sign paradigm” apply to ECDSA cryptography?

From wikipedia https://en.wikipedia.org/wiki/Digital_signature#How_they_work and other articles I see that: "There are several reasons to sign such a hash (or message digest) instead of the whole ...
0
votes
1answer
314 views

eXtended Merkle Signature Scheme (XMSS) vs Leighton-Micali Signature (LMS)

Very briefly, how does eXtended Merkle Signature Scheme (XMSS) stack up against Leighton-Micali Signature (LMS)? I'm asking this in the context of my article here.
1
vote
1answer
397 views

What are the advantages and disadvantages of Merkle signatures over Lamport signatures?

I know they are both hash-based and post-quantum secure, and that Lamport signatures can form the basis for a Merkle scheme, but what do you actually gain over standard Lamport signatures by doing ...
2
votes
1answer
104 views

Smallest 256-bit security hash-based OTS?

What is the smallest hash-based OTS in terms of the sum of the public key and signature which provides 256 bits of security?
3
votes
1answer
288 views

How to use SPHINCS+?

Based on the NIST submission it looks like the SPHINCS+-256s algorithm comes in at public key sizes of 64 bytes, private key sizes of 128 bytes, and signature sizes ...
5
votes
1answer
504 views

Difference Between Gravity-SPHINCS and SPHINCS+?

What are the differences between Gravity-SPHINCS and SPHINCS+ from security and practicality standpoints? Are they just different implementations of the underlying SPHINCS algorithms or are they ...
0
votes
2answers
115 views

Reversability of Xor'd Values In Hash?

This may be a dumb question so please forgive me if so, but is a hash function considered one-way even if you have half of an xor'd value? For example say I have the values R and C, both are randomly ...
2
votes
2answers
163 views

Blind Hash Signatures?

Is it possible to implement blind signatures with purely hash-based signature algorithms? Any whitepapers, code samples, etc on the subject would be helpful.
3
votes
1answer
193 views

What is a formal definition of strong one-time-secure signatures?

What is a formal definition of strong one-time-secure signatures? I know the Lamport's scheme is one of them, but what is the global definition of it?
0
votes
1answer
59 views

Sequential delayed release of chained HMAC keys for use as asymmetric signature

Iterative hashing of a private random seed can yield keys for use in HMAC, which if revealed publicly in reverse order and on predetermined schedule, can be used in a manner similar to other ...
3
votes
1answer
758 views

Winternitz One time signature security

There are two versions of Winternitz-One time signature scheme, $W-OTS$ and $W-OTS^+$ Security of both is as following $W-OTS$ is strongly unforgeable under chosen message attacks if $F$ is a ...