Questions tagged [signature]
Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].
1,423
questions
0
votes
0
answers
50
views
How to prove that signature hash is wrong without reveal message
Let's say we have Bob, Alice and third party.
Bob make message signature hash and upload to third party, then encrypt message with Alice pub key and send it to Alice
Alice receive message and decrypt ...
- 3
0
votes
0
answers
74
views
Is it safe to derive a secret from a signature?
Many blockchain users have wallets that hold a private key, which can interact with a website. For example, the website can request the wallet to sign a specific message.
'Do only sign this message if ...
- 143
1
vote
2
answers
234
views
The security of using a digital signature scheme twice with randomness
Suppose $\Pi=(Gen,Sign,Vrfy)$ is a secure signature scheme, is the following signature scheme $\Pi'$ secure?
$Gen'$: The same as $Gen$, output public-private key pair $pk,sk$ on input $1^n$
$Sign'$: ...
3
votes
1
answer
1k
views
Why do we need additional secret value (k) in ECDSA?
Formula for calculating an ECDSA signature (r, s) is:
s = k-1(z + qr)
k - private key for a random point R
z - hash of a message
q - original private key
r - x(R)
I am interested in why do we need ...
- 133
1
vote
1
answer
90
views
Is it safe to derive a Falcon512 key pair from a XOF output?
I'm working on a program that requires multiple key pairs from multiple algorithms to be derived from a single 128-byte master seed. However, I couldn't find an implementation for Falcon512 that ...
- 47
0
votes
0
answers
54
views
ElGamal signature scheme problem and unsure whether my calculations are wrong or that's the answer
Trying to solve problem with verifying a message through the ElGamal signature scheme and I end up getting two different values.
I'm given a prime number p=881
, e1=3,
d=60
, and a random value r=11
. ...
- 1
0
votes
1
answer
65
views
How does FORS: Forest of Random Subsets work?
I saw a post named "How does signing with FORS work in SPHINCS+?" but in the post it seems like no one had explain how does the FORS works.
SK: Secret Key, PRF: Pseudo-Random Function
I'm ...
0
votes
0
answers
28
views
Is hashing really enough for data integrity or needs signing? [duplicate]
Hashing functions are used for data integrity when integrated with signing asymmetric algorithms but I miss a step. In multiple sources like here or here I read for granted that hashing algorithm per ...
- 129
1
vote
2
answers
1k
views
Why is SHA256 used as a layer on top of Digital Signature [duplicate]
Digital Signatures use an asymmetric algorithm, meaning that if I want to apply a digital signature to a document I sign it with my own private key and send it to the recipient.
The recipient, thanks ...
- 129
3
votes
1
answer
458
views
Current Digital Signature Standards as of late 2023
Is my summary understanding of current (classical) Digital signature standards essentially correct? I may be totally wrong.
DSA is no longer to be used for new signature generation just for checking ...
- 21.2k
0
votes
1
answer
106
views
Does "Signing" always mean encrypting a hash
Does signing always involve encrypting a hash or can we call private key encryption of an unhashed message signing too?
- 103
2
votes
1
answer
83
views
Use zk-STARK for post-quantum signature scheme?
Could you not use zk-STARK for a post-quantum signature scheme?
Your private key is a random symmetric encryption key, your public key is the hash of the encryption key.
To sign you run an algorithm ...
- 169
0
votes
0
answers
42
views
Is this ECDSA's protection mechanism or something wrong with it?
Over the past few months, I have been reading and trying to understand how ECDSA works and how safe is it.
So now something does not add up between its signature verification and generation.
But maybe ...
0
votes
0
answers
44
views
What is the purpose of $k \in \{2, \dots, p-2\}$ in ElGamal signatures on ${\mathbb{Z_{p}^{*}}}$?
The question is mainly stated in the title. I had to do a refreshment on public key cryptography. The algorithms are pretty straightforward however, I always stumbled upon this question. Is it in ...
- 878
2
votes
0
answers
40
views
Off-The-Record and Multi-Designated Verifier Signatures
What technique is used in the Off-The-Record protocol to implement authentication and message validation? And what is the difference between this technique and Multi-Designated Verifier Signatures?
...
- 21
0
votes
2
answers
74
views
Is signature same as hash value encrypted with the private key in openssl?
Computing the signature of hello.txt file which has the text hello in it, here is done in two steps:
...
1
vote
1
answer
60
views
Signal protocol: are One-time prekeys derived from Signed Prekey or just randomly generated?
Do signal protocol derive One-time prekeys from Signed Prekey with some KDF or are they just randomly generated in the same way as Signed Prekey?
- 409
0
votes
0
answers
28
views
Signature algorithm/protocol with fillable gaps?
Consider how a cheque-book works: Alice goes to the Bank, and gets some incomplete messages, like ...
- 101
1
vote
0
answers
25
views
If a SoK satisfies simulatability and extractability, is this signature unforgeable and non-malleable?
This paper[1] defines the simulatability and extractability of the signature of knowledge (SoK).
As is widely known, a secure signature scheme should be both unforgeable and non-malleable. Can we ...
- 63
0
votes
1
answer
67
views
Can a Sigma protocol be transformed into a signature of knowledge through Fiat-Shamir transform？
As is well known, a sigma protocol can be transformed into a NIZK protocol through a Fiat-Shamir transform.
But can the Sigma protocol be transformed into a signature of knowledge in a similar manner?
...
- 63
1
vote
0
answers
54
views
Can lattice attack work MSB or LSB are unkown but 16 bytes of private key are known?
I have been reading about lattice attack on ECDSA when partial bits of nonce are known for amount of signatures, So i went through some source code trying to understand how it works.
First of all, ...
1
vote
1
answer
57
views
What happens when a Merkle Tree OTS scheme runs out of keys
A Merkle Tree OTS scheme such as XMSS pregenerates 2^h keys that are tied to 1 public key
When the 2^h keys run out, does all the 2^h keys get removed/deleted and the device pregenerates another new 2^...
- 13
1
vote
1
answer
50
views
Regarding the Digital Signature Algorithm During Client Authentication in TLS 1.2
In TLS 1.2, when client authentication is carried out, digital signatures are utilized. However, at what point is the specific signature algorithm communicated to the server? It seems to me that the ...
- 11
-1
votes
2
answers
131
views
Encrypt with private key decrypt with public key
I want to sign and transmit a short message, which contains a few simple hashes. My objective is not to prevent an attacker from inserting a fake message, but to ensure that the attacker cannot define ...
- 99
1
vote
1
answer
41
views
PRNG to Obtain Random Subset (PORS) Success Probability
PORS (PRNG to ORS) is a secure variant of the HORS few-time signature scheme. In PORS, instead of using a hash function, it uses a message (and salt) as a seed of PRNG and query it until obtains k ...
- 11
1
vote
1
answer
61
views
Can someone explain in simple terms how coding part and the algorithm itself, of dilithium pqc signature algorithm resemble here?
I am stuck here and can't map the coding part to the algorithm.
$$\underline{\text{Power2Round}_q(r, d)}\\
r := r \bmod^+ q\\
r_0 := r mod^\pm 2^d\\
\textbf{return}\big((r-r_0) / 2^d, r_0\big)
$$
What ...
1
vote
1
answer
48
views
How have the authors performed uniform random sampling for the secret values s1 and s2 in dilithium?
I am currently trying to understand and implement the design of post quantum algorithm signature algorithm Dilithium. I have read the document several times and they have just used uniform random ...
- 35
4
votes
2
answers
454
views
Why does OpenSSL RSA signing process need the public exponent?
I am trying to fully separate RSA key pairs by breaking down $(N,e)$ for public part and $(N,d)$ for private part. From my understanding of RSA signature process, the message to be signed is digested ...
- 43
2
votes
1
answer
139
views
In dilithium (post quantum signature algorithm), how have the authors precomputed the table of zetas for NTT?
I am trying to understand the design rationale of in place NTT in Dilithium. I know that how the splitting of polynomials is done but I cant seem to map this approach to the precomputed table of zetas ...
- 35
2
votes
1
answer
258
views
Does RFC 6979 unconditionally prevent nonce-reuse attacks?
Is RFC 6979 guaranteed to prevent the reuse of nonces for different signed hashes?
- 3,645
0
votes
1
answer
90
views
Elliptic curve signature scheme without a nonce
ECDSA and EdDSA both require the generation of a single-use value. Are there any elliptic curve signature schemes in existence which don't require nonce and maintain the usual security strength equal ...
- 3,645
1
vote
1
answer
84
views
js-ethereum-cryptography secp256k1 signature difficulties
I'm currently undertaking a course on Blockchain cryptography. And our first project is to transfer tokens from one wallet to another using client / server application. All mock of course.
This ...
- 139
0
votes
1
answer
28
views
Is it wrong that in a JWK, if the "d" value is **omitted**, that JWK represents a private key?
This is not a programming question. This is to confirm whether a crypto documentation is incorrect.
I am using Rust's p384 crate. I am creating a private key from a JWK string.
In the source code, at ...
0
votes
1
answer
59
views
Reason for two random numbers in DSA?
Why is the signature in DSA the way it is?
I am referring to $r$ and $k$ in the Signing-Algorithm depicted below. Is it really necessary to have both, $r$ and $s$, or would it still be secure if only ...
- 21
0
votes
1
answer
35
views
Is it safe to sign a short token with salted md5
I want to generate some tokens for client as http cookie
can I md5 them with salt and then use "<random token>"+"<md5>" as the token ...
0
votes
1
answer
42
views
Deriving a signature without the signer
Say we have an element $g=H(m)$ in a group (this element may or may not be a generator of the group).
Are there signature schemes that enable to sign this element, and then to be able to derive a ...
- 239
0
votes
1
answer
53
views
Ring Signature's "solve for y_s" step in Rivest et al.'s "How to leak a secret"
I'm reading Rivest et al.'s "How to leak a secret", but I'm having a hard time understanding step 4 of the generation procedure. This could be because of my own lack of knowledge regarding ...
- 1
1
vote
1
answer
50
views
Unconditionally Secure Signature Key Generation
I'm reading through a paper called Unconditionally Secure Signatures (https://eprint.iacr.org/2016/739) and to generate keys, the authors select $\epsilon-ASU_2$ functions, such that:
For any $m \in ...
- 415
0
votes
0
answers
328
views
Private Key Signing in C# and Public Key Verifying in Java and Swift
I create this question from here.
I am working on a project with C# backend and mobile apps using Java and Swift.
I found this documentation to use RSACryptoServiceProvider.SignData method to sign ...
- 101
1
vote
2
answers
1k
views
Is there a way to get time from signature? Or is it possible to ensure the message was signed at the time that it says it was signed?
Suppose my server receives a message, the public key, and the signature. The message contains a time stamp.
Is there a way to get the time stamp from the signature to match it with the message time ...
3
votes
1
answer
613
views
When using ECDSA P-384 for signing and verifying messages, should the public key be also included **INSIDE** the message before signing?
I am using ECDSA P-384 for signing and verifying messages. The messages are basically stringified JSON. After receiving, the recipient verifies the signature using the public key.
Should the public ...
2
votes
1
answer
135
views
Digital signature with private key on exchange
I think I understand how asymmetric cryptography works. However I don't really understand why some exchanges use the signature generated by hashing the payload with the private key.
From my ...
- 123
1
vote
0
answers
32
views
Ethereum signature as xml-dsig11
This question was originally posted in https://ethereum.stackexchange.com/questions/151471/ethereum-signature-as-xml . I post it here aswell because I rarely get any response there.
I am seeking to ...
- 111
0
votes
0
answers
31
views
Academic papers for the pros and cons of password based system and digital signature with challenge and response system
I don't really know what should be the correct title for this and the community can correct it after reading.
I was the author of PKDSA (Searchable on github).
I have the idea to do it because I feel ...
- 125
0
votes
0
answers
12
views
Statistical effect of inceasing private key shares' bit length in threshold RSA signature
By using additive sharing of the private key over the integers, one can obtain a simple threshold RSA signature scheme.
It provides security against a passive adversary.
The dealer chooses random $d_{...
- 363
2
votes
1
answer
83
views
Digital signature scheme with blinded public key
I need a digital signature scheme with the following characteristics, but I don't know what it's called, so I'm having trouble searching for publications about it. It seems likely that something like ...
- 123
2
votes
1
answer
137
views
Can I check if a PGP signed message has been modified when I don't have the public key
Is it possible to check if a PGP signed message has been modified when the public key of the signer is not available?
Like, is there a message digest (hash) that can be checked without knowing the ...
- 210
0
votes
1
answer
73
views
How can I send someone a large file safely without using key exchange protocols (for encryption)?
I recently took an exam where one of the questions was roughly the following:
You need a specific way for sender S to send a large file M to a receiver R with their secret-public key pair, without ...
- 23
2
votes
1
answer
121
views
Why isn't the provided scheme UF-CMA secure?
On an exam I recently took, one of the questions was:
Consider the following signature scheme. The public key is $(p,g,g^x)$, where $p$ is a large prime number. $g$ is a generator of $\mathbb Z^*_p$, ...
- 23
0
votes
0
answers
66
views
Why using linear increasing nonce in DSA in a bad idea?
Suppose we sign and verify messages with a DSA scheme. Before signing the first
message the necessary parameters $(p,q,h,g,x,y)$ are initialized, including the nonce $k$ as an integer between $(1,q-1)$...
- 1