Questions tagged [signature]

Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

Filter by
Sorted by
Tagged with
1
vote
1answer
48 views

How to use ECDSA test vectors?

I would like to verify my system by running ECDSA NIST test vectors, but I am not getting expected output. I am able to calculate signature, but it is not right or at least "r" and "s&...
1
vote
1answer
26 views

Split, sign, and combine [closed]

I have a device that signs (symmetrically) very short messages, and I would like to sign a long one. I split it into several short messages, signed each one separately, and now combine all the ...
2
votes
0answers
31 views

Why does OAuth 1.0a require random nonces and how random should they be?

What are the requirements of a nonce? <- Typically it is only required that a nonce is unique, however, in certain cases harsher requirements (such as randomness and unpredictability) are put. The ...
1
vote
0answers
31 views

Is it possible to recover the private key if the same message is signed twice with different nonce? [duplicate]

Sorry if this question is misguided, I'm a software developer and not a cryptographer. Let's say I have a public key, and 2 signed messages. Signed message 1: ...
0
votes
1answer
57 views

Is the Key Exchange authenticated and confidential?

I have made a private messaging program and would like to check that nothing is stupid in my use of cryptography. I am an amateur and nothing is for production. I thank you in advance. The message ...
1
vote
2answers
54 views

Is it possible to verify that the output of an executable came from its unaltered control flow?

I suppose an executable could contain a key which signs its output, but that key could be extracted and used to sign other data. Is it possible to verify that the output of an executable is the direct ...
-1
votes
1answer
23 views

Dsa generator verify problem

I'm trying to generate a signature for DSA with the following parameters: p=67 , q=11 , g=38 , H(m)=7 , x=6 (Is it correct to choose g=38?) I cannot choose a random k (0>k>q) that will give me r ...
3
votes
0answers
75 views

"Electronic signature" legal definition

A proposed California law contains the following definition: (i) “Electronic signature” means an electronic sound, symbol, or process attached to or logically associated with an electronic record and ...
0
votes
2answers
98 views

Digital Signatures forgery on 60000 messages with brute force

Assume an operating system uses digital signatures to ensure executable files can be authenticated and can't be modified; where the digital signatures are constructed by creating a hash of the ...
1
vote
1answer
249 views

Is it possible to cryptographically sign a message with a private key while keeping the pre-image content public?

Essentially, I am looking for a way for user A to create a signed message that user B can 1) verify user A wrote (ie using ecrecover) and 2) the content of the message can be read by user B without ...
0
votes
1answer
86 views

Does sha256 is ok for that? If not does EC?

I think from what I studied that I had the correct reasoning, but I would like a double check. Here is the thing: Given two matrix: A and B I calculate the hashFunction(A, B) = C Now I calcultate the ...
0
votes
0answers
26 views

Post quantum deterministic strongly EUF-CMA secure signature scheme?

I am trying to figure out if there is a known construction of a post quantum secure EUF-CMA secure signature scheme for which the signature procedure is deterministic. It seems that it is possible to &...
2
votes
1answer
77 views

Add a non-signer to an already-signed message

This is a follow-up to the first comment of this answer. A message is signed with the private key of $A$, $s_A$. We know $p_B$, the public key of $B$, but not $s_B$, their private key. Is it possible, ...
0
votes
1answer
46 views

Hybrid Authentications

Is there a reason why we can't combine private key MAC with digital signature to get a hybrid authentication scheme? Is it because of the computational assumptions that digital signatures have? Edit: (...
1
vote
1answer
55 views

Using CMAC instead of hash function for message signing [duplicate]

Generally, when we want to generate a signature for message M we use hash function H, and sign the result of H(M) with the private key. What if instead of hash function H we would use a CMAC with key ...
2
votes
1answer
18 views

Are the user's required to be different in Boneh et al.'s aggregate signature scheme?

Boneh et al. [1] describe an aggregate signature scheme, which allows signature aggregation of $n$ distinct messages from $n$ distinct users into a single short signature. In their description, they ...
7
votes
2answers
475 views

signatures that are verifiably generated by one of several private keys without revealing which one

is there an encryption algorithm that allows to: generate a set of different private keys sign data with those private keys allow to publicly verify that such a signature has been created by ONE of ...
1
vote
1answer
41 views

Current status of ring signatures/proof of set membership

I understand the original O(n) implementation of a ring signature, but I'm trying to figure out where the state of the art is on signing a message as an anonymous member of an ad hoc group without ...
0
votes
0answers
11 views

How to sign CAM/DENM messages using mbed LTS libray with ECDSA (EEE Std 1609.2)

I have read ETSI TS 103 097 and EEE Std 1609.2 which gives me the security data structure defined in ASN.1 notation. I want to use mbed LTS to calculate the ECDSA signature. I understand that I should ...
1
vote
1answer
54 views

Using one seed to create signing key pair and encryption key

I'm working on creating a secure digital vault. I'm using mnemonic to generate a seed. The seed is used to generate a signing key pair for identity verification. However I want to also encrypt the ...
0
votes
0answers
13 views

Are there applications of sanitizable signatures without transparency property?

Are there applications of sanitizable signatures without transparency property ?
2
votes
0answers
30 views

Designated verifier signature from Diffie–Hellman and a MAC

Here is an idea for a designated verifier signature scheme. Suppose Alice and Bob know each other’s public keys and Alice wants to send a message to Bob, such that only he will be convinced of its ...
5
votes
0answers
80 views

Is qTesla Secure?

qTesla is a signature scheme and a submission to the NIST post-quantum standardization process, which made it to the second round. It is based on the hardness of RLWE. The NIST round 2 status report ...
0
votes
1answer
41 views

Security of ElGamal signature scheme with generator of small order

For $p$ a 1024-bit prime, we have a 1021-bit element $g \in \mathbb{Z}_p^*$, where the order of $g$ is much smaller than the order of $\mathbb{Z}_p^*$. How does this small-order $g$ affect the ...
3
votes
2answers
80 views

Prove that $x$ is the sum of digitally signed numbers without revealing the summands

Imagine this: Charlie chooses two integers $x_1$ and $x_2$ and signs each of these integers with the same private key. Charlie sends the following to Alice: $x_1$ and $x_2$, the two signatures, and ...
0
votes
0answers
22 views

How to estimate the parameter of a lattice signature scheme with lossy reduction?

The parameter of a lattice signature scheme DAZ19 with tight reduction can be choosed to make the underlying hardness problem intractable. How to estimate the parameter of a lattice signature scheme ...
1
vote
4answers
109 views

Does SSL connection provide integrity?

I'm new to cryptography and I'm trying to implement a secure chat application using OpenSSL. I want to ensure that public messages (which will be shown to all users) cannot be altered during ...
3
votes
0answers
36 views

parameter estimating in lattice signature scheme

when reading [BDLOP18], I run the lwe-estimator with the recommended parameters in Table 2 , but the result of hermite factor is 1.007, this result is bigger than the recommended hermite factor 1.0035
0
votes
0answers
36 views

Is it possible (and if so how) to make one proof for multiple private keys in ECDSA

Lets say I have a message that needs to be signed by two keys that were generated using ECDSA Is it possible to make a signature that accounts for both keys, meaning I can verify with both and see ...
1
vote
0answers
38 views

Should Ed25519 verification multiply by the cofactor?

The standardization document for Ed25519, RFC 8032, says the following method should be used for verifying Ed25519 signatures: Check the group equation $[8][S]B = [8]R + [8][k]A'$. It's sufficient, ...
0
votes
1answer
56 views

How to ensure the data comes from verified source without using asymetric encryption

I'm building a project that is remotely controlled using LoRa and I want to ensure, that nobody can imitate my transmitter and send packets to my receiver. Just encrypting sent data is not enough ...
0
votes
0answers
41 views

Does hash-then-sign provide confidentiality?

Suppose I use the hash-and-sign paradigm and reveal a signature on the message digest $\sigma(H(m))$. Would just revealing this signature violate message confidentiality (assuming H is one-way and ...
0
votes
0answers
22 views

Is there a way to ensure that the signer has generated a valid (message, signature) pair without seeing the message?

Suppose Alice sends message $Enc(k_{AB}, m)$ to Bob where $k_{AB}$ is the common symmetric key. Next Alice sends a signature of $H(m)$ $\sigma_{sk_A}(H(m))$ signed under her private signing key $sk_A$ ...
2
votes
1answer
75 views

kleptography SETUP attack in ecdsa

I'm trying to implement kleptography SETUP attack of ecdsa with python. Just a simply script to verify the algorithm. However i can't get the right output as the paper said. Where is the problem? Can ...
1
vote
0answers
23 views

Looking for a (partly) anonymous signature

I am looking a way to sign a document, so that everyone could verify that one person out of a group did, but only a special person and/or the group could know who signed it. Let's say, X chooses a ...
1
vote
2answers
117 views

Signature of low-entropy data: can they be faked?

I am working on an application where I have a physical product identification label containing a block of public, low-entropy data (~50 bytes) such as serial number and other info, all readily ...
0
votes
0answers
46 views

A tool to generate and verify signature of a binary file

I'm looking for an easy to use tool to generate RsaPssSha256 digital signature of a binary file using the private key. and verify the signature using the modulus and exponent of the public key. any ...
0
votes
1answer
64 views

Reference for a formal definition of universal forgery and EUF-CMA

In many papers, I see EUF-CMA and SUF-CMA referenced as a canonical term used, but I did not find a reference paper/book that ...
1
vote
1answer
105 views

In general, how do e2e messaging platforms deal with changes to the structure of the encrypted data?

I'm a layman trying to deepen my understanding of crypto and private messaging by building a (proof-of-concept) centralized, end-to-end encrypted messaging "platform". Messages are sent by ...
0
votes
1answer
50 views

Is RSA in ciphersuites secure?

Ciphersuite website says TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 is secure but how do I know which RSA is used for the signature generation? If its the hashed one, where you hash the message before ...
0
votes
1answer
114 views

Why a private key is used to encrypt hash in digital signing

In common RSA encryption, a public key is used to encrypt message, and private key decrypts it. However, in digital signing, it's the other way around: Bob hashes his message, then encrypts the hash ...
0
votes
0answers
19 views

Group Signature by Camenisch and Stadler

Page 8, Paper: "Efficient Group Signature Schemes for Large Groups" by Camenisch and Stadler (1) I was trying to understand membership certificate part. I am have only basic knowledge of ...
0
votes
1answer
56 views

Authentication of certificates

In order to provide authenticity of a sent message, we use certificates as fingerprints. But how do I know that the certificate is not stolen by someone? If the certificates are made public, why cant ...
1
vote
1answer
76 views

How is a keyImage linked to a ring signature?

I'm trying to understand the concept of ring signatures. So as it seems there is a way where you have a group of public keys which can be signed by only one private key of that group without revealing ...
0
votes
0answers
40 views

Is it possible to extract a signature from a HTTPS webpage?

Let's say I want to prove to someone that a webpage claims X. I could take a screenshot, but it could easily be doctored. However, the webpage's contents are encrypted by the domain using its private ...
2
votes
1answer
49 views

Natural resistance to side channel attacks of XMSS/LMS/SPHINCS+

All these post quantum signature schemes are claimed by the authors to be naturally resistant to side channel attacks. My question is, why or how?
2
votes
1answer
132 views

How do we pick random elements in cryptography?

While reading papers on cryptography, a lot of time I have seen that people pick random elements $x\in \mathbb{Z}^*_q$ to do something (like setting secret key and all). How does one randomly pick ...
1
vote
1answer
140 views

Is it possible to create a Dilithium Prime or Falcon Prime?

In the NTRU Prime submission, principle author, the well-known DJB is adamant that [the] primary objective [of NTRU Prime] is to eliminate unnecessary complications in security review So much so, to ...
1
vote
0answers
64 views

Can a PKE scheme be turned into a signature scheme?

Recently, I have been wondering whether you can turn any PKE scheme into a signature scheme and, if so, how (is there a general construction, or is this scheme-specific?). I have found several posts ...
3
votes
0answers
113 views

What short signature standard?

In some applications like QR-codes, saving 25 bytes out of 100 makes a difference in usability. What choice is there for a signature scheme with (most important criteria first) As small as possible ...

1
2 3 4 5
25