Questions tagged [hash-signature]

Hash-based digital signatures, such as Lamport one-time signatures, are digital signature schemes based on a (non-trapdoor) one-way function such as a cryptographic hash. Such schemes are expected to remain secure even against attacks using quantum computers.

Filter by
Sorted by
Tagged with
2
votes
1answer
46 views

How secure is a hash based signature scheme after signing assuming quantum computers?

Consider a hash based signature scheme that requires taking the $k$-bit hash of an arbitrary length message to be signed (e.g. Lamport one-time signature scheme). My understanding is, assuming that ...
1
vote
1answer
28 views

Keyed Hashing and verification

Is there any standard algorithm where I can create a hash H(x,k) where x being the data and k being the private key. And verify on other end with H(x,l) where l being the public key? How it can be ...
0
votes
1answer
27 views

Difference between XMSS and MSS-SPR

I am currently studying stateful hash based signatures. In the XMSS paper the authors claim that XMSS signatures are 4 times smaller than those of MSS-SPR. However I do not get how it is possible, ...
0
votes
0answers
22 views

JWTs vs Capability Tokens

One of the primary advantages of JWTs is that they serve as capability tokens, allowing for a portable verification of capabilities/ privileges. However, JWTs are often criticized for a number of ...
8
votes
1answer
998 views

What is the difference between signatures and VRF?

For example we have asymmetric signature scheme(RSA or ECC based) and VRF(also can be RSA/ECC based), both of them can be verified using public key of the signer/hasher and also are unique for each ...
2
votes
1answer
78 views

How is SPHINCS Hash-based signature “stateless”?

I really hope someone can help me with these questions related to SPHINCS. I am trying to understand the concept of “stateless” vs. “stateful” signature scheme which is the basis of SPHINCS. I went ...
1
vote
1answer
56 views

Signing a message using SPHINCS Hash-based Signature scheme

I have questions on “SPHINCS: practical stateless has-based signature” by Bernstein et al. And I really hope that someone can help me with it. To help me understand it, I read the https://...
0
votes
1answer
42 views

In W-OTS, is it trivial to forge smaller N values?

Just read about W-OTS, since the signature is the private key hashed 256-N times, is it trivial to forge a signature with a smaller vale for N when having access to original signature? I.e. just hash ...
1
vote
0answers
21 views

How does the KeyGen of Merkle's improvement of Lamport's OTS work?

In his paper [1] on page 17 and 18, Merkle proposes an improvement on Lamport's OTS by only signing the 1's in the message in combination with a checksum of the amount of 0's in the message. I get the ...
1
vote
0answers
31 views

short signature for EC

i'm building a low-power wireless sensor network in which each slave node has a public/private ECC key pair -- generated by the node itself during manufacturing.... the slave node is also provisioned ...
0
votes
0answers
22 views

Security implications of an extra inner encrypt for a single block Matyas-Meyer-Oseas hash function

Was giving some thought to simple MMO constructions for fast single block hash functions for things like PQ crypto. There's Haraka, but that's not standard and readily available while simple AES is in ...
1
vote
1answer
58 views

Forging RSA1024 signature with e=3 where hash is right justified

I am trying to understand (in the frame of exponent 3) how to calculate a "forgery" in the case where the desired result is: xxxxxxxxxxx[...]xxxxxxxxxxxxxxxxxxxxHHHHHHHHHHH[...]HHHHHHHH where HH = a ...
3
votes
0answers
28 views

Are there any hash-based multisignature schemes?

Are there any hash-based signature schemes which would let two (or more) people sign the same message without increasing the size of the signature linearly? For my purposes, it is fine if the scheme ...
0
votes
1answer
47 views

In W-OTS, could you XOR all public keys?

Since the signatures all generate the public keys, those can be derived from sig and proven by pre-commited XOR of every pub key compared with XOR of every signature end hash.
0
votes
0answers
67 views

Signature Generation with RSA PKCS#1 v.15

I am trying to validate my RSA implementation for digital signatures with the test vectors provided by NIST. For now, I am focusing on the tests for signature generation (SigGen15) with the PKCS#1 v....
2
votes
0answers
21 views

Strategies for fast integrity attestation over multi party computation for large messages

I am looking for ways to efficiently perform integrity attestation over large messages using multi party computation. While, hashing (SHA1, 256...) is one alternative but it's painfully slow and grows ...
1
vote
3answers
123 views

Digital Signature Algorithm for large files - bottle-necked by hash function?

I am new to studying digital signatures like ECDSA and EdDSA, and was curious about something. Lets say hypothetically I want to create a digital signatures of millions of files, with a total size of ...
2
votes
1answer
3k views

How can one validate with a public key a JWT signature generated with a private key?

As I understand it, a JSON Web Token (JWT) consists of 3 parts: the header, specifying the hashing algorithm to use for the signature; the payload itself; and the signature, which is a hash of the ...
3
votes
1answer
65 views

SPHINCS and HORST: can we sign the same message twice?

I was reading about SPHINCS which uses layers of WOTS+ trees and a bottom layer of HORST trees. HORST is a few time signature scheme, using a selection function you can sign at least twice without ...
0
votes
1answer
41 views

Basic question on hash-based signature scheme

If a hash-based signature schemes such as W-OTS is used, do we still need public key based certificates to prove ownership of a public key? I understand that hash-based signatures are one of the ...
1
vote
1answer
70 views

Digital signature

I learned that a digital signature is encrypted using private key and is decrypted using public key. How does the verifier gets the public for verifying the signature? If a person has to request ...
0
votes
1answer
179 views

Does RSASSAPSS use RSA signature

I just need to know is it correct to classify the RSASSAPSS scheme and sha[256 | 512 | 1]WithRSAEncryption all under RSA ...
1
vote
1answer
633 views

What is the recommended minimum key length for ECDSA signature

I want to identify the proportion of certificates that use unrecommend ECDSA key length for TLS certificates based on some data I collected. By looking at a standard like NIST for example, I find ...
1
vote
1answer
142 views

DSA signature generation [duplicate]

I am trying to implement given DSA signature generation instructions in python, there are few instructions that I couldn't understand in step 3 and 4. Let m be an arbitrary length message. The ...
0
votes
1answer
241 views

Use partial hash to verify entire hash

I've had an idea about storing parts of SHA256 hashes and I'd like to find out how secure it is, or how much less secure it is than storing the entire hash. For example, users can share this list of ...
1
vote
1answer
112 views

Does the One-Time Hash-based Signature Scheme render Ring Signatures useless?

On the Bitcoin community, to maintain privacy, they recommend using one-time spend addresses. CryptoNote, Monero et al. prefer Ring Signatures to maintain that privacy. There are some issues regarding ...
3
votes
1answer
37 views

For a hash over a finite space without size reduction, is a public permutation sufficient?

Suppose the application is a Lamport signature scheme. Is the following a secure hash $\{0,1\}^n \rightarrow \{0,1\}^n$? $$ H(x) = x \oplus P(x) $$ where $P$ is a public permutation that permutes an ...
1
vote
1answer
277 views

How does the user get the private/public key with HMAC based request signing?

I need to implement a HMAC signing of requests and I have read this article which explains the basics of what it is and how to achieve on theory. https://blog.andrewhoang.me/how-api-request-signing-...
1
vote
1answer
107 views

Bitmasks or seed along with public key in WOTS+ post-quantum signatures

The state of the art hash-based post-quantum signature schemes, like Sphincs and XMSS, are using variations of WOTS (Winternitz OTS), like WOTS+, that require extra random bitmasks along with the ...
9
votes
3answers
5k views

Winternitz One-Time Signature

I am reading the page 38 in this "Post Quantum Cryptography" book (Equations 8 and 9). My question is, why to compute the verification key $Y$, $f$ is applied $2^w-1$ times? Are there any security ...
1
vote
2answers
93 views

Why does WOTS+ need a checksum during signing operation?

I was reviewing WOTS+ scheme for consideration in our private blockchain, and noticed that it had a small overhead of calculating a checksum as seen in the following pseudocode excerpt from the ...
0
votes
1answer
350 views

eXtended Merkle Signature Scheme (XMSS) vs Leighton-Micali Signature (LMS)

Very briefly, how does eXtended Merkle Signature Scheme (XMSS) stack up against Leighton-Micali Signature (LMS)? I'm asking this in the context of my article here.
48
votes
11answers
15k views

How do hashes really ensure uniqueness?

This might seem an impractical and unnecessary conversation, but I feel it's something I need to clarify. Especially, as I just got my first developer job in a blockchain startup. So hashes are said ...
2
votes
2answers
115 views

Does the Server Key Exchange sign a hash or text

In TLS 1.2 when using ECDHE_RSA, the ServerKeyExchange message contains a signature over the server's ECDHE public parameters. My question is: Is the signature over ...
-2
votes
2answers
162 views

How to determine if a Hash function is preimage resistant?

So I'm trying to solve this problem. There are of course more but I'm trying to figure out how would I even solve this first one in order to do the rest. Any hints or help in the steps would be ...
0
votes
1answer
59 views

How many messages before Sphincs(+) becomes insecure?

How many messages would it take until the success probability of a forger becomes $1/2$? $1/4$?
3
votes
2answers
257 views

Usability of padding scheme in blinded RSA signature?

In Wikipedia's article on Blind signature, in the section Dangers of blind signing which describes RSA blinding attack one reads the following This attack works because in this blind signature ...
0
votes
2answers
99 views

The use of Elliptic Curves as part of a blockchain transaction

As I understand it, Elliptic-Curve Cryptography is used in the verification step of a transaction (i.e. when creating a digital signature), but not in the creation and security of a 'block' (when ...
1
vote
1answer
48 views

Cryptographically secure hash function vulnerable to length extension attacks both to front and to back?

Is there any hash function where both $\text{hash}(m\|k)$ and $\text{hash}(k\|m)$ are vulnerable to length extension, but $\text{hash}(m)$ is itself secure?
-1
votes
1answer
44 views

I am new to digital certificate 509V3 concept. can some one please clarify the below points [closed]

I am using RSA 2048 with SHA 256 primitive in certificate: How to verify the user certificate n + 1 with Root certificate n? why it is required to perform Certificate chain verification? How to ...
0
votes
1answer
257 views

Why is SubtleCrypto API generating different signature for same data?

I am trying to generate key pairs using SubtleCrypto API in javascript and then using the same to sign some data using ECDSA algorithm. Documentation for the same can be found at this link. https://...
2
votes
1answer
3k views

Security of chameleon hash functions

With the knowledge of the trapdoor, we are able to compute the same digest for differents messages. I've read that given two messages $m$, $m'$ and two numbers $r$, $r'$ such that $Ch(m,r)=Ch(m',r')$...
0
votes
1answer
175 views

Is it safe to hash a packet with a shared secret to prove authenticity?

I am developing an online game, where the server is written in Node.js and the client uses Godot. The issue is that Godot has no cryptographic functionalities (it can only encrypt and decrypt files, ...
2
votes
1answer
72 views

Why is WOTS-type signature schemes OTS?

I'm sure I've missed something super trivial, but why are WOTS-type schemes one-time? I've been looking into hash-based schemes, and I feel like I understand WOTS quite well (specifically I have ...
2
votes
0answers
116 views

Can this hash-based, short signature scheme work, given a decentralized log of messages as a primitive?

Suppose we had a decentralized log of messages, i.e., an ever-growing array of information on which anyone could append arbitrary data to. Given such primitive, could a party broadcast authenticated ...
0
votes
1answer
816 views

How is public key cryptography used for digital signature?

In public key cryptography, there are two different keys used for the encryption and decryption of data . I am wondering how it is used for digital signature
0
votes
1answer
43 views

Convert a state-dependent hash-based signature scheme into a stateless message-dependent one

Suppose we have an XMSSMT instance that is capable of signing up to 2^60 messages securely when given some state-dependent information, I could envision making it stateless as follow: Hash the ...
6
votes
3answers
784 views

Why do we need Collision Resistant Hash Function for the Merkle Tree Signature Scheme?

I am studying Merkle Tree Construction for digital signature. I don't quite understand why we need collision resistant hash function for Merkle tree construction. There are few papers like XMSS that ...
0
votes
2answers
156 views

Digital signatures with one-way function, can messages be longer than the signature?

Ethereum and Bitcoin both use 512 bit signatures, can the message that is being signed be longer than 512 bit?
1
vote
1answer
412 views

What are the advantages and disadvantages of Merkle signatures over Lamport signatures?

I know they are both hash-based and post-quantum secure, and that Lamport signatures can form the basis for a Merkle scheme, but what do you actually gain over standard Lamport signatures by doing ...