Questions tagged [signature]

Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

Filter by
Sorted by
Tagged with
-3 votes
0 answers
31 views

Show that BadSign algorithm is not secure [closed]

Consider the following RSA-based signature scheme that we will call BadSign. H is a hash function mapping onto $Z_n^*$. Procedure Keygen($1^λ$): n = p · q; φ = (p − 1)(q − 1); Select e such that 1 &...
Land's user avatar
  • 71
0 votes
2 answers
67 views

New Service to Service Protocol Presented for Public Scrutiny (Time-based Token Signing), Is it Safe?

I came up with the following protocol to provide a life-time for JWT tokens while differentiating services to communicate securely with web services (service-to-service) using symmetric key signing ...
Adam Memisyazici's user avatar
0 votes
1 answer
97 views

Should hash salt and public key be a part of cryptographic signature?

I'm updating some piece of software I wrote quite some time ago. It is supposed to sign some content. So at the moment I have the following process: I have a (private, public) keys pair. These can ...
freakish's user avatar
  • 103
1 vote
0 answers
10 views

Is aggregator consider trustworthy in a CLAS scheme

In certificateless aggregate signature (CLAS) scheme, is an aggregator consider trustworthy? Can they act as an adversary, where they can alter the messages from the users and create a new valid ...
Rabindra Moirangthem's user avatar
1 vote
1 answer
42 views

Signing a file vs. a manifest of cryptographic hashes

I’m interested in the tradeoffs of signing individual files vs. signing a manifest of cryptographic hashes and file names. Let’s say I do some work that results in a handful of files (10s to hundreds),...
baseboard49's user avatar
1 vote
0 answers
61 views

Random padding of RSA-signed message at end instead of beginning of the message

I’ve a signature scheme for 1024‒bit RSA with a 65537 exponent. The signed message is constructed as follows: 760‒Bits fully_user_controlled_message_content+8 Bits incremental nonce+sha256(...
user2284570's user avatar
2 votes
0 answers
47 views

Can signature be repurposed?

Given public key $pk$, message $M$ and its signature $\sigma$, is it possible to get another $pk'\not =pk$, $M'$ with the totally same signature $\sigma$? In other word, the following ones are both ...
Twiforest's user avatar
4 votes
1 answer
127 views

Changing ECDSA for Shorter Signatures: deterministic k

I am exploring a modification to ECDSA to produce shorter signatures, even though it compromises security (in a controllable way). My rationale behind this change is in this discussion. In my ...
Ehsan's user avatar
  • 51
0 votes
0 answers
15 views

Why record signing in Rekor when using private key?

Intro When using cosign for keyless signing, the flow that happens is as such: The user runs cosign sign to sign an artifact Cosign redirects the user for a OpenID ...
YoavKlein's user avatar
  • 159
1 vote
0 answers
20 views

Can an aggregator be a type 1 adversary?

In a certificateless aggregate signature scheme, can a signature aggregator be a type 1 adversary (external attacker who can have access to secret value of a user)? I thought signature aggregator is ...
Rabindra Moirangthem's user avatar
0 votes
0 answers
27 views

Signature forgery in different adversarial settings

I'm currently studying the different adversarial settings for digital signatures. In Goldwasser, Micali and Rivests paper they propose three different chosen message attack settings, which are vastly ...
limeeattack's user avatar
0 votes
1 answer
66 views

EdDSA protection of deterministic algorithm against replay attacks

EdDSA generates the private nonce deterministically by hashing the private key and the message, and this means that the public nonce $r$ and the signature s will be same if the same message signed ...
Nawras Hussein's user avatar
0 votes
2 answers
194 views

sign a JWT with RS256 using a RSA-PSS SHA256 key pair?

Given a private key using algorithm RSA-PSS with SHA256 is it possible to use this key to sign a JWT using algorith RS256 (RSA with SHA256) instead of PS256 (RSA-PSS with SHA256)? The German ...
Basti's user avatar
  • 103
1 vote
0 answers
66 views

Encryption + EUF-CMA => SUF-CMA

Does there exist a proof (paper reference welcome) that if a signature scheme is EUF-CMA, and the signatures are always encrypted, then the resulting signature scheme is SUF-CMA? That is: let SIG be ...
Mario's user avatar
  • 31
3 votes
1 answer
74 views

How to reconstruct low order bits of $t$ of CRYSTALS-Dilithium from a small number of signatures?

In FIPS 204 (https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.204.ipd.pdf): "The vector $\textbf{t}$ is compressed in the actual public key by dropping the $d$ least significant bits from each ...
Jong Hyeok Lee's user avatar
2 votes
0 answers
419 views

How could a 1024‒bits RSA modulus be most economically factored within months today?

Of course this is a question with an answer that is due to evolve. A 2002 paper about TWIRL stated that the cost would be around 10M\$ and an other 10M\$ to manufacture the device. A later 2007 paper ...
user2284570's user avatar
0 votes
0 answers
19 views

Aggregate Signatures Overview

I've been learning about aggregate signatures lately, are there any overviews or learning materials about aggregate signatures (including security properties)?
Ping Ping's user avatar
0 votes
0 answers
29 views

P256 signature verification was succeed with 2 public key [duplicate]

I tried to recover public key from P256 signature. With 2 recovery id ( 0, 1 ), signature makes 2 public key. And I tried to verify signature with public key and verification was succeed all of 2 keys....
박해성's user avatar
1 vote
0 answers
61 views

Using Deterministic ECDSA (secp256k1) Signature as a Cipher Key in Symmetric Encryption

I'm exploring the security implications of utilizing a deterministic ECDSA signature as a cipher key for symmetric encryption and would appreciate insights from the community. Here's the setup I'm ...
landabaso's user avatar
  • 111
1 vote
0 answers
91 views

Does 'digitization' of tickets always need private data? Or is it just data gathering? Any simple method without?

Many companies argue their gathering of private data with 'digitization' but I guess their real intention is most likely just gathering data. However I didn't came up with a simple idea without it. ...
UncleBob's user avatar
6 votes
2 answers
356 views

RSA signatures without padding by using XOF output in range [1, n-1]

RSA signatures are implemented by encrypting the padded hash with the private key. Why not take the approach RSA-KEM is using by removing the padding entirely and replacing the hash with a XOF that ...
Jackie Lanhorn's user avatar
1 vote
1 answer
212 views

Differences between two RSA signatures using OpenSSL

I want to sign a file called data.txt and store its signature in data.txt.sig. To create the signature, I want to use an ...
Allgaeuer's user avatar
  • 123
4 votes
1 answer
225 views

Split a private key into shares and sign successively or separately

Assume I have a private key, priv_k, a public key pub_key and a message, msg, along with its ...
Ryan's user avatar
  • 141
0 votes
1 answer
86 views

Looking for a modifiable signature!

I am a graduate student and have encountered some problems in my research. When I generate a signature on the data block of the file, and the signature is composed of the user's private key, the data ...
nan gan's user avatar
1 vote
0 answers
58 views

ring signature with embedded data

As part of Spontaneous Anonymous Group (SAG) signatures of say 16 participants, the prover generates fake random responses for 15 elements and a real response at some secret index. I want to hijack ...
sandeep kiran p's user avatar
2 votes
1 answer
120 views

Is it safe to "sign" a message with such a zk proof

I am building an application in which I need to sign a message without revealing my entire identity. To do so, I just compute a zk proof with the following purpose: prove I own the secret key sk ...
Makubu's user avatar
  • 21
0 votes
0 answers
64 views

How to prove that signature hash is wrong without reveal message

Let's say we have Bob, Alice and third party. Bob make message signature hash and upload to third party, then encrypt message with Alice pub key and send it to Alice Alice receive message and decrypt ...
byXrom's user avatar
  • 3
0 votes
0 answers
103 views

Is it safe to derive a secret from a signature?

Many blockchain users have wallets that hold a private key, which can interact with a website. For example, the website can request the wallet to sign a specific message. 'Do only sign this message if ...
koeppelmann's user avatar
1 vote
2 answers
255 views

The security of using a digital signature scheme twice with randomness

Suppose $\Pi=(Gen,Sign,Vrfy)$ is a secure signature scheme, is the following signature scheme $\Pi'$ secure? $Gen'$: The same as $Gen$, output public-private key pair $pk,sk$ on input $1^n$ $Sign'$: ...
Kagura Hitoha's user avatar
3 votes
1 answer
1k views

Why do we need additional secret value (k) in ECDSA?

Formula for calculating an ECDSA signature (r, s) is: s = k-1(z + qr) k - private key for a random point R z - hash of a message q - original private key r - x(R) I am interested in why do we need ...
LeaBit's user avatar
  • 133
1 vote
1 answer
100 views

Is it safe to derive a Falcon512 key pair from a XOF output?

I'm working on a program that requires multiple key pairs from multiple algorithms to be derived from a single 128-byte master seed. However, I couldn't find an implementation for Falcon512 that ...
Zola Gonano's user avatar
0 votes
0 answers
81 views

ElGamal signature scheme problem and unsure whether my calculations are wrong or that's the answer

Trying to solve problem with verifying a message through the ElGamal signature scheme and I end up getting two different values. I'm given a prime number p=881 , e1=3, d=60 , and a random value r=11 . ...
Justin B's user avatar
0 votes
1 answer
131 views

How does FORS: Forest of Random Subsets work?

I saw a post named "How does signing with FORS work in SPHINCS+?" but in the post it seems like no one had explain how does the FORS works. SK: Secret Key, PRF: Pseudo-Random Function I'm ...
a15600712's user avatar
0 votes
0 answers
30 views

Is hashing really enough for data integrity or needs signing? [duplicate]

Hashing functions are used for data integrity when integrated with signing asymmetric algorithms but I miss a step. In multiple sources like here or here I read for granted that hashing algorithm per ...
Tarta's user avatar
  • 129
1 vote
2 answers
2k views

Why is SHA256 used as a layer on top of Digital Signature [duplicate]

Digital Signatures use an asymmetric algorithm, meaning that if I want to apply a digital signature to a document I sign it with my own private key and send it to the recipient. The recipient, thanks ...
Tarta's user avatar
  • 129
3 votes
1 answer
536 views

Current Digital Signature Standards as of late 2023

Is my summary understanding of current (classical) Digital signature standards essentially correct? I may be totally wrong. DSA is no longer to be used for new signature generation just for checking ...
kodlu's user avatar
  • 22.5k
0 votes
1 answer
141 views

Does "Signing" always mean encrypting a hash

Does signing always involve encrypting a hash or can we call private key encryption of an unhashed message signing too?
kzs's user avatar
  • 103
2 votes
1 answer
120 views

Use zk-STARK for post-quantum signature scheme?

Could you not use zk-STARK for a post-quantum signature scheme? Your private key is a random symmetric encryption key, your public key is the hash of the encryption key. To sign you run an algorithm ...
LightTunnelEnd's user avatar
0 votes
0 answers
47 views

Is this ECDSA's protection mechanism or something wrong with it?

Over the past few months, I have been reading and trying to understand how ECDSA works and how safe is it. So now something does not add up between its signature verification and generation. But maybe ...
Alexio puk2sefu's user avatar
0 votes
0 answers
45 views

What is the purpose of $k \in \{2, \dots, p-2\}$ in ElGamal signatures on ${\mathbb{Z_{p}^{*}}}$?

The question is mainly stated in the title. I had to do a refreshment on public key cryptography. The algorithms are pretty straightforward however, I always stumbled upon this question. Is it in ...
tur11ng's user avatar
  • 962
2 votes
0 answers
43 views

Off-The-Record and Multi-Designated Verifier Signatures

What technique is used in the Off-The-Record protocol to implement authentication and message validation? And what is the difference between this technique and Multi-Designated Verifier Signatures? ...
Ping Ping's user avatar
0 votes
2 answers
120 views

Is signature same as hash value encrypted with the private key in openssl?

Computing the signature of hello.txt file which has the text hello in it, here is done in two steps: ...
user112060's user avatar
1 vote
1 answer
67 views

Signal protocol: are One-time prekeys derived from Signed Prekey or just randomly generated?

Do signal protocol derive One-time prekeys from Signed Prekey with some KDF or are they just randomly generated in the same way as Signed Prekey?
pacman's user avatar
  • 429
0 votes
0 answers
29 views

Signature algorithm/protocol with fillable gaps?

Consider how a cheque-book works: Alice goes to the Bank, and gets some incomplete messages, like ...
Danya02's user avatar
  • 101
1 vote
0 answers
26 views

If a SoK satisfies simulatability and extractability, is this signature unforgeable and non-malleable?

This paper[1] defines the simulatability and extractability of the signature of knowledge (SoK). As is widely known, a secure signature scheme should be both unforgeable and non-malleable. Can we ...
user109993's user avatar
0 votes
1 answer
86 views

Can a Sigma protocol be transformed into a signature of knowledge through Fiat-Shamir transform?

As is well known, a sigma protocol can be transformed into a NIZK protocol through a Fiat-Shamir transform. But can the Sigma protocol be transformed into a signature of knowledge in a similar manner? ...
user109993's user avatar
1 vote
0 answers
101 views

Can lattice attack work MSB or LSB are unkown but 16 bytes of private key are known?

I have been reading about lattice attack on ECDSA when partial bits of nonce are known for amount of signatures, So i went through some source code trying to understand how it works. First of all, ...
Alexio puk2sefu's user avatar
1 vote
1 answer
63 views

What happens when a Merkle Tree OTS scheme runs out of keys

A Merkle Tree OTS scheme such as XMSS pregenerates 2^h keys that are tied to 1 public key When the 2^h keys run out, does all the 2^h keys get removed/deleted and the device pregenerates another new 2^...
Vincent Lew's user avatar
1 vote
1 answer
104 views

Regarding the Digital Signature Algorithm During Client Authentication in TLS 1.2

In TLS 1.2, when client authentication is carried out, digital signatures are utilized. However, at what point is the specific signature algorithm communicated to the server? It seems to me that the ...
dusk's user avatar
  • 11
-1 votes
2 answers
187 views

Encrypt with private key decrypt with public key

I want to sign and transmit a short message, which contains a few simple hashes. My objective is not to prevent an attacker from inserting a fake message, but to ensure that the attacker cannot define ...
user23952's user avatar

1
2 3 4 5
29