Questions tagged [hash-signature]

Signature schemes built out of and based on properties of hash functions. **DO NOT USE THIS TAG** if the signature is based on other hard problems and just happen to employ a hash function.

Filter by
Sorted by
Tagged with
0 votes
0 answers
36 views

A CERTIFIED DIGITAL SIGNATURE paper pg 20 - 25

Reference paper: "A CERTIFIED DIGITAL SIGNATURE" With reference to the image above which is from Page 20 of the attached paper. What is this new protocol that the paper speaks of here? What ...
user avatar
  • 45
2 votes
1 answer
206 views

Questions on "A CERTIFIED DIGITAL SIGNATURE" Pg. 19

Referenced paper here. The above excerpt is from Page 19 of attached paper. I have a few questions. y = F^9(x) is equivalent of F(F(F(F(F(F(F(F(F(x))))))))) ? The excerpt says that this allows us to ...
user avatar
  • 45
0 votes
0 answers
18 views

Why we need DSPR or Eq. 14 for the proof of SPHNICS+?

The paper says that We show that preimage resistance (PRE) follows tightly from the conjunction of second-preimage resistance (SPR) and decisional second-preimage resistance (DSPR). As I understand ...
user avatar
  • 73
2 votes
1 answer
74 views

Lamport Diffie One-time Signature

I am going through the Lamport Diffie One-time signature. I am having a hard time understanding How can long messages (greater than 100 bits) can be mapped into short messages (100 bits) by a one way ...
user avatar
  • 45
0 votes
0 answers
50 views

Is there a cryptography algorithm for signing values with two keys and requiring both to verify it?

Is there an algorithm that lets me sign a value with two keys at the same time, and in turn requires both keys to verify the signature? For instance, a scheme could work like this: Sign X with Key1 ...
user avatar
  • 101
1 vote
0 answers
52 views

How to find strength of a cryptographic hash function?

I am having an idea to create a cryptographic hashing algorithm. I found a mathematical function $f: x \rightarrow y$ . By using Merkle-Damgård construction wide pipe, I designed a hashing function. ...
user avatar
0 votes
1 answer
37 views

Why are WOTS and WOTS+ one-time schemes?

I've been doing some reading on hash based signature schemes, specifically XMSS and thus the underlying Winternitz scheme (WOTS+ to be precise). As their names suggests, WOTS and WOTS+ are one time ...
user avatar
1 vote
1 answer
56 views

Why do we need both bitmasks and keyed hash in SPHINCS+

I think one of them is related to multitarget attacks and the other is related to collision attacks. But I cannot find how hash based crypto related to hash collisions. 1-) Consider the following ...
user avatar
  • 73
2 votes
0 answers
52 views

Hash verification by key

I want to implement the following algorithm, but don't know what tools to use. D - data I generate some universal value for D - Y I generate some random key - K, get a hash of D by this key - H I ...
user avatar
0 votes
1 answer
116 views

Does sha256 is ok for that? If not does EC?

I think from what I studied that I had the correct reasoning, but I would like a double check. Here is the thing: Given two matrix: A and B I calculate the hashFunction(A, B) = C Now I calcultate the ...
user avatar
1 vote
1 answer
89 views

What is the security strength of XMSS according to NIST PQC categories?

In the context of the NIST PQC standardization process, NIST has defined the following five security categories: Any attack that breaks the relevant security definition must require computational ...
user avatar
  • 2,674
0 votes
0 answers
39 views

How does not tagging hashes result in leaking the secret key if a nonce is re-used in a different scheme?

I'm reading through BIP340 and I'm having trouble understanding this part: For example, without tagged hashing a BIP340 signature could also be valid for a signature scheme where the only difference ...
user avatar
3 votes
1 answer
108 views

What hash based digital signature algorithms exist that have reasonably small signature sizes?

What hash based digital signature algorithms exist that have reasonably small signature sizes? By reasonably small, I mean not much bigger than what you would get with a 256-bit ECDSA (which I ...
user avatar
  • 133
0 votes
0 answers
56 views

Decrypt one cipher with multiple and independent passwords

Consider that an online shop subscribes an embedded external service for their customers. This external webpage is accessible through a clickable banner on the online shop. On the subscription area of ...
user avatar
  • 113
1 vote
1 answer
81 views

How is a keyImage linked to a ring signature?

I'm trying to understand the concept of ring signatures. So as it seems there is a way where you have a group of public keys which can be signed by only one private key of that group without revealing ...
user avatar
4 votes
1 answer
291 views

Is $H(k || m) \oplus k$ secure?

It is known that $H(k || m)$ (when using SHA1) is an insecure MAC function since it is vulnerable to hash length extension. But what about $H(k || m) \oplus k$? A normal hash length extension seems to ...
user avatar
1 vote
3 answers
104 views

Hash function collision importance

Suppose a collision has been found in a certain hash function, such that H(x1) = H(x2) However, x1 and x2 are both a seemingly 'random' collection of bits which do not convey a coherent message, and ...
user avatar
  • 11
-2 votes
1 answer
43 views

Problem understanding the difference between passphrase and keyfiles

Ok, so I have read a few different articles on subject and am maybe just just having problems understanding the point of view from the program I am using or maybe not IDK. Anyhow, ill get into it. ...
user avatar
10 votes
3 answers
5k views

Why is SHA3 more secure than SHA2?

Why are SHA3 algorithms considered more secure than their SHA2 counterparts? Surely in part, it is due to their resistance to length extension attacks. But specifically, when considering collision ...
user avatar
0 votes
1 answer
51 views

Can we use symmetric/hashing functions to sign messsages as a quantum-proof replacement of public-private key signing?

Public-private key signing generally works like this: I announce my pubic key. I encrypt something with my private key. If people managed to decrypt (2) with (1) then (2) is from the owner of (1). ...
user avatar
  • 519
0 votes
1 answer
54 views

How to do the WOTS checksum

As far as I understand, the Winternitz one-time signature is made by: Making an array of private keys. Making an array of public keys by hashing each private key X times, X being the number of ...
user avatar
  • 1
0 votes
1 answer
108 views

How many valid signatures can the same message have using ElGamal?

I know that messages in ElGamal are not deterministic, so a message can have more than one valid signature. But is the number of valid subscriptions infinite?
user avatar
  • 103
3 votes
1 answer
72 views

Making WOTS+ public keys shorter

In WOTS+ — as described in section 3 of RFC 8391 — public keys, private keys and signatures all consist of $len$ strings with $n$ bytes each, where $len, n \in \mathbb{N}$. Is it safe to use the hash ...
user avatar
2 votes
1 answer
67 views

Are my calculations about WOTS parameters correct?

I'm reading the WOTS+ paper, but I'm having some trouble with its notation and specially the involved units. For example, under my interpretation, the parameters ...
user avatar
  • 1,295
2 votes
1 answer
55 views

How do I construct the Fn family of functions of WOTS+ using SHA3?

From the WOTS+ paper: Furthermore, W-OTS+ uses a family of functions Fn : {f_k : {0, 1}^n → {0, 1}^n | k ∈ Kn} with key space Kn. The reader might think of it as a cryptographic hash function family ...
user avatar
  • 1,295
3 votes
1 answer
131 views

Is NOTS a valid one time signature scheme?

I've just learn about NOTS, a quantum-resistant signature scheme based on hash functions that claims to have much shorter signature and key sizes. Is this signature scheme known to be secure? From ...
user avatar
  • 1,295
0 votes
0 answers
44 views

Algorithm to validate 1 of N inputs is part of output hash

Is there an algorithm that allows proofing that an input x1 was used as 1 out of N inputs to create an output hash y, without ...
user avatar
  • 101
0 votes
1 answer
86 views

Two Different Ciphers with Same MD5

I was wondering if someone could help explain md5 collision abit better. I found this resource: https://www.mscs.dal.ca/~selinger/md5collision/ where they provided an example of where two cipher texts ...
user avatar
0 votes
1 answer
311 views

How secure is AES 256bitkey generated from PBKDF2

I am using CryptoJS AES 256 encryption: CryptoJS.AES.encrypt(realData, generateKey(passphrase), {iv: iv}); The secret is generated through: ...
user avatar
0 votes
0 answers
19 views

Can Merkle signatures be leveraged for key exchange?

A Merkle signature scheme is post-quantum-suitable as it relies only on the security of a one-way function. However, this construction seems to only be capable of authentication, and not ...
user avatar
1 vote
1 answer
57 views

What's the use of SHA on Non Digital Signature applications?

What's the use of SHA on Non Digital Signature applications? Why is SHA1 not a risk for Non Digital Signature applications? What's the difference between Non Digital Signature applications vs. Digital ...
user avatar
1 vote
0 answers
46 views

Hashing Public Key of Lamport or Winternitz OTS

For the Lamport or Winternitz public keys, couldn't one just hash down the large public key to 256 bits in order to greatly reduce the public key size while still having basically the same security? ...
user avatar
0 votes
0 answers
38 views

Is there a name for this simple identity verification scheme?

Once, while idly wondering, I came up with a simple scheme to prove the authenticity of a chain of messages given the authenticity of the first. It consists of putting a hash at the end of each ...
user avatar
0 votes
2 answers
43 views

LMS Security Proof Paper

Is there any LMS security proof besides the one mentioned in RFC 8554? Does LMS actually have a paper which describes a proof?
user avatar
0 votes
1 answer
38 views

XMSS MT for height 80

The XMSS RFC supports only tree heights of 60, which makes the chosen keypair to sign up to 2^60 messages, which is not practical for the use of SSL and so on. The paper https://eprint.iacr.org/2017/...
user avatar
2 votes
0 answers
85 views

Is it more, or less, secure to use a different $F$ and $G$ for a Lamport signature?

A Lamport signature is made as follows: Alice stores $k_1, \cdots, k_{n'} \leftarrow K $ as her "private key", with one-way function $F: K\to V$, $n'>n$, and (easily enough) all $F(k_i)\...
user avatar
1 vote
1 answer
174 views

What does $\text{PK}=\text{pk}\oplus\text{H}(\text{opk})$ represent in this paper?

In Lu, Au and Zhang's 2019 paper (Linkable) Ring Signature from Hash-Then-One-Way Signature, they …extend [M. Abe, M. Ohkubo, and K. Suzuki's 2019 1-out-of-n signatures from a variety of keys] ...
user avatar
4 votes
1 answer
322 views

Why are LMS and XMSS not candidates in the Post-Quantum Cryptography Standardization process?

Why are Leighton-Micali Signature Scheme (LMS) and eXtended Merkle Signature Scheme (XMSS) not candidates in the NIST Post-Quantum Cryptography Standardization process? Both are mentioned in the final ...
user avatar
  • 143
-2 votes
0 answers
35 views

AES CBC Encryption Key & Special ASCII characters [duplicate]

Can we add characters like α π Σ µ ...
user avatar
  • 3
-1 votes
2 answers
2k views

Special characters in AES Encryption Key

We all know that AES uses Key, IV and salt. But what if we add special ASCII characters like Alternate 255 (" ") or Alternatively 163 ("£") or Alternate 224 ("α") in the ...
user avatar
  • 3
1 vote
0 answers
52 views

How to compare two post quantum digital signature schemes in terms of latency?

I want to compare two digital signature schemes of different nature. One is Hash-based (Winternitz one time signature scheme) and the other is lattice-based (Dilithium Crystals). What about be an ...
user avatar
1 vote
0 answers
43 views

How to evaluate number of security bits of a signature scheme?

I am trying to evaluate the effective security levels that a digital signature scheme (namely post-quantum digital schemes like WOT-S (Winternitz one time signature scheme) and Dilithium Crystals). ...
user avatar
2 votes
0 answers
42 views

How can one-way hash functions in the signatures help by using same algorithm for encryption and signature verification?

I read some documents about digital signatures and one way hash functions, etc., but everything was too complicated and I don't have much experience in cryptography. Can anyone explain to me in a ...
user avatar
  • 21
1 vote
0 answers
55 views

How to prove that the given encryption scheme have ciphertext indistinguishability for all PPT adversaries?

I am not sure how to prove that the given two scheme is perfectly indistinguishable for all PPT adversaries!
user avatar
0 votes
1 answer
83 views

Leighton-Micali Hash-Based Signature key sizes

I am working with the RFC for Leighton-Micali Hash-Based Signatures: RFC-8554. The question is if I understood it correctly and my calculations of the key sizes are correct. Basically, LMS uses ...
user avatar
  • 143
1 vote
0 answers
63 views

Implementing LMS

I already created my own version of the hash based signature scheme LMS, but my signing results do not match the test vectors provided in the RFC. I am not sure what I do wrong, thus I wanted to try ...
user avatar
  • 49
1 vote
1 answer
96 views

How does TLS 1.3 work with PQC signatures?

I know that the first step in TLS 1.3 with modern signatures is hash the message with SHA256/SHA384/SHA512. Do PQC signatures work the same as modern algorithms in TLS 1.3?
user avatar
  • 75
2 votes
1 answer
47 views

Using XMSS with Blake2

Since XMSS only requires a 2nd preimage resistant hash function, is using Blake2 in XMSS possible? It is not in standard, but Blake2 seems to be faster than SHA256
user avatar
  • 49
0 votes
0 answers
101 views

Guarding against vulnerabilities for a digital signature service (RSA )

Lets's say I have a cipher-module / cryptography-service that signs a hash of some unknown payload. What are the possible attacks that I would need to guard against in this context (primarily assuming ...
user avatar
1 vote
1 answer
87 views

How secure is LMS?

LMS is a hash-based digital signature scheme. It is a standard alongside of XMSS, which has it's bit-security stated in the paper(about 200bit-security for standard parameters). LMS security ...
user avatar
  • 49