Questions tagged [signature]

Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

Filter by
Sorted by
Tagged with
2 votes
0 answers
25 views

RSA small public exponent signature forgery - use part of the public key as cyphertext

I would like to ask you about what I think is a variation of BB'06 signature forgery¹. Unlike BB'06 where the forged signature is valid for any pkey with e=3 the one I have is valid only for one pkey. ...
user avatar
  • 21
1 vote
0 answers
56 views

Which quantum resistant digital signature algorithm would you use and why (If you had to pick one now)? [closed]

Context: Many widely used public-key cryptographic schemes have been designed based on the difficulty of factoring and similar problems. That includes RSA, the Diffie-Hellman Key Exchange, ECDH, ...
user avatar
0 votes
0 answers
28 views

Weak and Strong Unforgeability for Known Message Attacks

For signatures, there is the security goal of existential unforgeability. As seen here and noted here (german source) the security goal can be split into weak and strong unforgeability for chosen ...
user avatar
  • 1,492
1 vote
1 answer
50 views

Signature check decrypts ciphertext

Can somebody lead me to existing literature on making the extraction of plaintext dependent on a valid signature check first? I didn't think it was possible to force signatures to be checked; but this ...
user avatar
  • 319
1 vote
0 answers
55 views

Stateful hash signature without Merkle trees

When it comes to stateful schemes, would you really need to use a Merkle tree? Couldn't you sign the hash of the message concatenated to the hash of the new public key? New public key: hash(hash(...
user avatar
0 votes
2 answers
61 views

Size of signature

I was wondering what is typically the size of digital signature for every 1-bit data that is signed. I am trying to figure out how size of messages increases if I send only the data in a message or ...
user avatar
0 votes
0 answers
48 views

Using ed22519 signature as entropy

I am developing an application in which all application state is entirely public. Each user of the application is equipped with their own ed22519 keypair, and the application can only ask users for ...
user avatar
0 votes
0 answers
14 views

Do L-trees remove the need of collision resistance hashes in XMSS MT?

I read that the bitmasks in XMSS-MT lower the security requirements from a collision resistant undetectable hash to a 2nd preimage resistant undetectable hash (see LMS vs XMSS: Comparion of two Hash-...
user avatar
0 votes
1 answer
41 views

Are Encryption, Key Exchanges and Digital Signature the application of asymmetric encryption

Reading the wikipedia entry on asymmetric cryptography, will I be wrong to conclude that there are 3 main broad category of application for asymmetric cryptography? Mainly: encryption digital ...
user avatar
3 votes
1 answer
127 views

Is RSA-signing zero knowledge?

Is RSA-signing a given challenge $x$ a zero-knowledge proof of holding the RSA private key, for the modern definition of zero-knowledge proof (which I don't know!) Assume public and genuine RSA public ...
user avatar
  • 124k
2 votes
1 answer
65 views

ASN.1 integer question for DSA

I'm trying to implement own DSA signature check as per guide at this site page 20 in python. ...
user avatar
6 votes
2 answers
1k views

Did digital signatures come from Zero Knowledge Proofs?

I am reading the Real-World Cryptography book and in the chapter on signatures it says: The best way to understand how signatures work in cryptography is to understand where they come from. For this ...
user avatar
0 votes
0 answers
30 views

Verifying meeting by sending same signed random number to central authority?

I am trying to develop a simple protocol for two users to verify (with respect to a trusted central authority) that they have (intentionally) met/communicated with each other. My idea was this: Users ...
user avatar
  • 101
1 vote
2 answers
106 views

Difference signature / asymmetric encryption (PQC)

The NIST is currently trying to select new standards for post-quantum cryptography. The two main categories for the candidates are "Public-key Encryption and Key-establishment Algorithms" ...
user avatar
  • 51
0 votes
0 answers
21 views

Tools to debug handshake failure after client key exchange, change cipher spec and encrypted handshake message TLS1.2

Hello I have been receiving Description : Handshake failure after sending client encrypted handshake message to the server. Is there any tools I can use instead of wireshark to detect the source of ...
user avatar
1 vote
1 answer
51 views

Working with Paillier and ECDSA - Order issue

I'm trying to implement two party computation for ECDSA signing using Paillier cryptosystem. But my problem is that the order of Paillier is different from the order of the curve (secp256k1 in my case)...
user avatar
  • 113
1 vote
0 answers
43 views

Signature delegation without secret keys

Scenario: have an entity A that cannot hold any secret keys. A concrete example would be: an application that needs to be open sourced and cannot be modified. In order to send any signed messages, it ...
user avatar
  • 111
1 vote
1 answer
69 views

Does Man-In-The-Middle attack isn't possible when we use reverse of RSA algorithm in Digital Signature?

We know that in RSA algorithm Sender A can send an encrypted message to receiver B without any prior exchange of secret keys. A just uses B's public key to encrypt the message and B decrypts it using ...
user avatar
0 votes
2 answers
76 views

E382 and E521 edward curves test vector

I need test vectors for E382 and E521 edward curves in order to test signature and verification process of a software.
user avatar
0 votes
2 answers
93 views

Isn't an asymmetric cipher (like RSA) algorithm sufficient for all basic needs, when speed is irrelevant?

Why I care: I want to implement some secure sessions for communicating over internet and since I am a complete amateur in this and don't want to spend a lot of time learning about cryptography or ...
user avatar
  • 115
1 vote
1 answer
45 views

Classical vs Quantum-Safe Algorithms and Protocols / Application Approach

Various proposals are being explored for X509 V3 certificates in a Post Quantum Cryptography (PQC) world. Currently, these include just having a certificate for classical and PQ, having a hybrid ...
user avatar
  • 145
0 votes
0 answers
30 views

What does prevent a hacker to calculate signature from message and public key without using private key? [duplicate]

I am talking about the process in the image: Everyone is saying this process is safe and and what I am claiming is impossible, but common sense says different.
user avatar
  • 101
0 votes
0 answers
12 views

Relation between oblivious linear function evaluation(OLE) can be used to build a PSI protocol

I read somewhere that oblivious linear function evaluation(OLE) can be used to build a PSI protocol. Is there any link between these two primitives?
user avatar
0 votes
0 answers
14 views

What non-trivial benefit does including a "context"/"signer info" provide in SM2-DSS and EdDSA?

While implementing SM2 DSS and reading RFC-8032 for EdDSA, I noticed that, both families of schemes provide provisions for including a "context" (in EdDSA) or "signer info" (in SM2 ...
user avatar
  • 6,621
2 votes
0 answers
74 views

Quantitative security of signature scheme obtained by Fiat-Shamir tranform

I'm looking for a quantitative yet simple proof of the EUF-CMA security of a signature scheme obtained by Fiat-Shamir transform. Recall the Fiat-Shamir transform starts from a 3-pass identification ...
user avatar
  • 124k
0 votes
1 answer
85 views

Proving you're from the year 2069

Just a question I thought of while playing an amazing game about time travel (13 sentinals aegis rim). What are the most bullet-proof cryptographic methods for proving you've come from beyond a ...
user avatar
  • 335
1 vote
2 answers
121 views

Digital signature forgery

My understanding of digital signatures is as follows: Alice hashes a message with a one-way cryptographic hash function, the output of which is called the message digest. She then encrypts the digest ...
user avatar
2 votes
1 answer
80 views

Lamport Diffie One-time Signature

I am going through the Lamport Diffie One-time signature. I am having a hard time understanding How can long messages (greater than 100 bits) can be mapped into short messages (100 bits) by a one way ...
user avatar
  • 45
0 votes
0 answers
53 views

Is there a cryptography algorithm for signing values with two keys and requiring both to verify it?

Is there an algorithm that lets me sign a value with two keys at the same time, and in turn requires both keys to verify the signature? For instance, a scheme could work like this: Sign X with Key1 ...
user avatar
  • 101
0 votes
0 answers
47 views

A doubt in pairing based cryptography

I have seen authors taking $G_1=G_2=G_T=G$ to be the same group of prime order $q$. What I know is that for pairing of type $$e:G_1\times G_2\rightarrow G_T,$$ size of the element in the target group ...
user avatar
1 vote
0 answers
39 views

Proving the range of a blinded value in a Pedersen commitment in zero knowledge

A prover has the following value: $$C = (h^ag^x)^b$$ and he needs to prove in zero knowledge to a verifier that $x < t$, for some public threshold $t$. The verifier knows $h$, $g$, $C$, and $t$. ...
user avatar
  • 23
1 vote
3 answers
163 views

How can you verify private key ownership using a public key and message signature?

When I sign a message with a private key, and I get a message signature, how is it that I'm able to - using the corresponding public key - verify that that message/transaction signature must have been ...
user avatar
  • 111
0 votes
0 answers
66 views

Using PRF as a building block to build other primitives?

I am doing an independent research in cryptography. I have designed a post-quantum secure pseudo random function. Just constructing a PRF will not help me to publish in reputed journals. I was ...
user avatar
2 votes
1 answer
122 views

Generating and validating a signature with ED25519 expanded private key

I am building a encrypted messaging app over tor network and currently I'm struggling on using tor generated ed25519 private key to sign and verify any message. Below piece of code works with a 32 ...
user avatar
  • 21
5 votes
2 answers
666 views

RSA Signing - Existential forgery and message prefix question. It's a weird one

I'm new to this. Please be kind. I have a theoretical question that I would like sanity checked: Bob and Alice are doing RSA signing without a hash function -- just putting a message in, and getting a ...
user avatar
1 vote
1 answer
62 views

Publicly verify that a a ticket was issued by an authority with around 8 digits

Im building a backend for webapp(s), so that we can sell tickets for our events. The events ranges from 100-700 guests. We sell tickets online and we would like to be able to scan the tickets at the ...
user avatar
  • 11
3 votes
3 answers
610 views

How can we prevent duplicate key attacks on digital signatures

A limitation digital signatures is that for a given signature σ of a message m corresponding to a public key pk, an adversary could generate a pk', sk' that produces a signature σ' for m, such that σ'...
user avatar
2 votes
0 answers
46 views

ECDSA adaptor signing and decryption

I am trying to understand this article. Can someone explain to me how the ECDSA adaptor signing is work? From the article: 1. ECDSA adaptor signing $$s' = (H(m) + R t p)r^{-1}$$ As I understand this ...
user avatar
4 votes
1 answer
157 views

Can a digital signature be used to generate a key for AES encryption?

I am looking to see if using a digital signature is a secure and reasonable way to generate a key for AES encryption. To flow would be as follows: A user signs a message ...
user avatar
  • 55
2 votes
0 answers
79 views

How can symmetric encryption be used to create a digital signature? Is it even possible?

I want to use symmetric encryption to create a digital signature. What can be the possible scenarios where symmetric encryption is used to create digital signatures?
user avatar
2 votes
2 answers
147 views

Signatures from asymmetric encryption

Let $(K_{enc},K_{dec})$ be an asymmetric key-pair. It seems to me that a signature scheme can be created by letting the public verification key be $K_{ver}=K_{dec}$ (the asymmetric decryption key) ...
user avatar
  • 165
0 votes
1 answer
36 views

Is BLS multi-signature aggregation separable?

In BLS multi-signature aggregation scheme we can combine different signatures of different peers into one single signature, and then we can verify whether the aggregated signature is truly signed by ...
user avatar
  • 45
1 vote
0 answers
30 views

Sampling from ring of integers

There is a statement in the paper "Asymptotically Efficient Lattice-Based Digital Signatures" by Lyubashevsky and Micciancio that says that "it is important that the ring of integers of ...
user avatar
  • 249
1 vote
2 answers
76 views

Is it safe to sign message with a TLS private key?

I want to sign all of the HTML and JavaScript from my site with the site's TLS private key. (The hex signature will be preceded with a <!-- comment which is ...
user avatar
  • 711
0 votes
1 answer
78 views

Are RSA-SHA256 signatures prone to length extension attacks?

I need to sign a message using a private key and verify the message with a public key, while making sure the message hasn’t been tampered. I know that SHA-256 itself is prone to length-extension ...
user avatar
  • 103
2 votes
0 answers
31 views

Software signing with openSSL

The company I work for wants me to implement some C functions to automatically sign their software. After doing some research I've found that openSSL is great for doing so. Before starting the ...
user avatar
  • 21
0 votes
1 answer
38 views

How to use OpenSSL to prove non-repudiation

If I download https://example.com/foo.txt, how can I prove to a third party that I got it from https://example.com. I understand that their private key is used to secure the channel, rather than to ...
user avatar
  • 711
0 votes
0 answers
29 views

Is there a cryptography primitive for public/private keys such that only keys from a predefined set will be valid

I am trying to accomplish the following: $Alice$ is an authority that can provide a secret $x$ to $Bob$, $x$ will enable $Bob$ to generate a public/private key pair $(p,q)$ which he can then use to ...
user avatar
1 vote
0 answers
67 views

Collision-resistant single-pass EdDSA?

Is there any reason why collision resistant variants of ed25519 that use a single-pass aren't used instead? For example: $n = h(noncekey \| m)$ $h(R \| pub \| n)$ instead of $h(R \| pub \| m)$ or ...
user avatar
2 votes
1 answer
49 views

Linkable/Tracable Ring Signatures Simple Explanation

I am currently in the process of understanding ring signatures. Now I have arrived at Linkable/Tracable Ring Signatures, however I don't really understand them. Can someone explain me how the ...
user avatar

1
2 3 4 5
26