Questions tagged [signature]

Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

Filter by
Sorted by
Tagged with
0
votes
0answers
3 views

Are there any signature algorithms with pseudorandom signatures?

As the title says. My reference point for the "pseudorandom ciphertext" concept is this paper by Möller, which introduces a public-key encryption algorithm with this property. I want to know the ...
5
votes
1answer
133 views

Difference between Pure EdDSA (ed25519) and HashEdDSA (ed25519ph)

My question refers to EdDSA as specified in RFC 8032. I get from the RFC that ed25519 and ed25519ph are two different instances of EdDSA mainly differing in the fact that that in the case of ...
4
votes
2answers
96 views

Isn't code signing just digital signature on code?

I have been trying to understand why code signing is treated or discussed differently from digital signature. Digital signature is signing a hashed BLOB with a private key. When the BLOB is code/...
1
vote
0answers
57 views

Efficient protocols for set membership proofs with private sets

I found the paper on Efficient Protocols for Set Membership and Range Proofs in which efficient protocols for the following problem are discussed: Given a commitment $C_v$ to a value $v$ we want show ...
0
votes
0answers
49 views

If I have two ECDSA signatures that use the same k (nonce) but different secret keys, can the secret key be computed?

I have two ECDSA signatures $(r, s_1, z_1)$ and $(r, s_2, z_2)$ where $s_1 = (z_1 + r*x_1) / k$, and $s_2 = (z_2 + r*x_2) / k$. Can $x_1$ & $x_2$ be computed?
0
votes
0answers
7 views

How to let CA signed x509 key work in OpenPGP mailing system?

So let's say we have a OpenPGP mailing system which all mails are signed and encrypted with OpenPGP keys. And now you bought a CA signed x509 certificate and you want to imement into the mailing ...
0
votes
0answers
48 views

Long-term signatures

I’m looking for suggestions on how best to handle signatures on audit records that might need to be held for many years (at least 5, maybe up to 10). Not in terms of storage - they’ll probably be ...
0
votes
0answers
10 views

How to protect HMAC key embedded in code from someone who would copy entire source? [migrated]

I and a friend are developing a web game. The front-end to back-end communication will be carried out by the means of an API. We realized that someone could then easily hook up to our API and make a ...
6
votes
1answer
277 views
+500

Is it safe to reuse a ECDSA nonce for two signatures if the public keys are different?

We denote the s value of an ECDSA signature $(r, s)$ on a message $m$ as: $s=\frac{H(m)+xr}{k}$ Assume two ECDSA signatures sharing the same nonce $(r, s_1) , (r, s_2)$ on two messages $m_1, m_2$, ...
0
votes
1answer
27 views

Difference between XMSS and MSS-SPR

I am currently studying stateful hash based signatures. In the XMSS paper the authors claim that XMSS signatures are 4 times smaller than those of MSS-SPR. However I do not get how it is possible, ...
1
vote
0answers
20 views

Include TSA Certificate in Timestamp Request

Im currently working on Timestamping and stumbled upon a parameter fRequestCerts/requestSignerCertificates/certReq that according to the documentations tells a TSA to include the certificate that was ...
0
votes
0answers
19 views

ElGamal: different message with equal length random key

This situation applies to ElGamal digital signatures: consider messages m1 and m2 which we will encipher with a random key. The random key has the same Hamming weight. Is this situation secure? Why? ...
1
vote
0answers
20 views

What signature schemes allow for a space efficient multisig? Any that also allow others to easily add to an existing signature?

For instance, Is there a scheme where 100 people could produce a signature that is only as long as one signature? Is there one like this that can be done where each person can merely modify an ...
0
votes
1answer
48 views

Signature verification vs decryption?

I've found this explanation regarding signature verification but I still confused In the example in the picture, the sender sign the hash using his secret key. The output of signing produces a ...
0
votes
0answers
28 views

Method for getting encryption keys from U2F key

There are a number of questions on this site about how/can you use a U2F key to encrypt something. The main problems with doing this are that U2F keys were designed for authentication, so all they can ...
16
votes
3answers
3k views

Digital signature that is only verifiable by one specific person

I would like to digitally sign a message in such a way that the signature can only be verified by one specific person. Simply encrypting the signature will not work, because that person could then ...
0
votes
1answer
40 views

Probabilistic verification of signature schemes like RSA?

I was wondering if there were any verification algorithm in the literature that enables a "probabilistic" verification of well-known signature schemes? For RSA signature verification for example, is ...
0
votes
1answer
35 views

Reasoning about WebCrypto ECDSA choices: P-256/384/521, SHA-1/256/384/512?

When implementing EC signing/verification in Javascript, the only options available via the WebCrypto API are: Curves: P-256, P-384, or P-521 Hashes: SHA-1, SHA-256, SHA-384, or SHA-512 If I was ...
2
votes
2answers
59 views

Whats wrong with my El Gamal signature example

I'm trying to digitally sign a message m using El Gamal. So far I've been unable to verify the digital signature ive made using El Gamal. I am using prime number, p = 8369. prime root g = 3031. ...
0
votes
1answer
28 views

Can randomness protect a list of signatures against forgery attacks?

Suppose we have a list of signatures $S = [s_1, .., s_n]$ for a list of messages $M = [m_1, .., m_n]$, and we want to verify that $S$ is a valid signature of $M$, so each $s_i$ should be valid for ...
2
votes
2answers
63 views

Distinguishing Original VS Fake Products

Let's assume that we want to distinguish original vs fake products when a customer receives them. I was thinking about using a protocol similar to digital signature. My question is can this problem ...
0
votes
0answers
34 views

How “Resending Message Attack” works?

In the second chapter of Bruce Schneier's book Applied Cryptography, 2nd Edition, 1996, we find this in section 2.7.1 Resending the Message as a Receipt: ...
2
votes
0answers
22 views

Test Vectors for XEdDSA

Anyone aware of test vectors (preferably with intermediate values) for the XEdDSA algorithm?
9
votes
4answers
210 views

Signature security proof in the Random Oracle model

As a study case, I consider the BLS signature scheme, but the following question is relevant in the general context of security proofs in the Random Oracle model. Let us briefly recall BLS signature ...
0
votes
1answer
82 views

Where does the certification come from?

In the second chapter of Bruce Schneier's book Applied Cryptography, 2nd Edition, 1996, we find this: Alice encrypts her message to Bob with KA and sends it to Trent. Trent decrypts the message with ...
0
votes
0answers
11 views

Using Chameleon-HF-enabled security in practice

If one were to implement a digital signature scheme that is only EUF-CMA-secure when using Chameleon Hash Functions, would one actually use a Chameleon Hash Function or a standard cryptographic hash ...
1
vote
1answer
29 views

Monero Ring CT sj calculation

For a university project, I am currently implementing the RingCT Ring signatures as used in Monero (before the introduction of Bulletproofs) as laid out in this paper. To close the ring we calculate ...
0
votes
1answer
33 views

Is there a lower limit on message length for signature?

I was working on a tool that signs small messages (~20 bytes) when a question occurred about message size: What would be the risk of using extremely small/restricted input (say, 5 bytes of hexadecimal ...
0
votes
0answers
69 views

Digital Signature Password verification

I currently have this TOFU protocol: First connection: Client generates salt and inputs a password Client saves salt Client hashes password with argon2 and salt Client generates Ed25519 keys Client ...
1
vote
1answer
61 views

NTRUSign (considered broken) as a one or few time PQ signature scheme

As many know, original NTRUSign is considered broken as signatures leak information about the private key. It takes a number of signatures to accomplish a break though, with the original break paper ...
1
vote
0answers
42 views

How to get the key data from the pkcs#8 format? [closed]

Being newbie to crypto, I understood that RSA keys are shared are pairs $(e,n)$ or $(d,n)$. But when I was given a doc with keys, they were in PKCS#8 format. How to get the keys out of this format?
1
vote
0answers
21 views

How does the KeyGen of Merkle's improvement of Lamport's OTS work?

In his paper [1] on page 17 and 18, Merkle proposes an improvement on Lamport's OTS by only signing the 1's in the message in combination with a checksum of the amount of 0's in the message. I get the ...
0
votes
1answer
40 views

How to prevent Public Key from being replaced entirely?

I am using RSA to sign my license file using Microsoft CNG API. I am signing the license file and sending the file with the <...
2
votes
1answer
62 views

How does the Signature Scheme in Picnic Works

I am trying to understand how signature scheme proposed to NIST, Picnic, works. The propossal uses ZKboo and ZKboo++ as their basis. I can see how the ZKPoK works, where the witness x is some key ...
1
vote
1answer
53 views

Does the signatures generated by a revoked member before revocation remains valid in VLR group signatures

Group signatures allow any member of the group sign the message on behalf of the group anonymously using his own secret-key. Only group manager can reveal the identity of the signer. Verifier Local ...
1
vote
1answer
47 views

Is it possible to derive related signature?

For example, the message is a json: {name: john, age: 13}, and is sealed with signature. Now, is it possible to derive a signature for the new message: ...
0
votes
0answers
43 views

Problem with e-cash system with multiple banks

Say that many banks issue electronic cash of a particular type. If there is a malicious bank and user collusion, the malicious bank signs electronic cash for a particular user. This user then takes ...
0
votes
1answer
53 views

Security strength EC signature for variable message size

I am implementing a system using some sort of 32bytes OTC (One-Time Code) and signing it with ECDSA to get verification of a public key owner. The key I'm using is ...
0
votes
2answers
78 views

How to understand Authenticated Key Exchange?

I am reading some articles about Key Exchange. I know classic key exchange,such as Diffie-Hellman key Exchange. This type algorithm is vulnerable to man-in-the-middle attack. However, When using ...
3
votes
1answer
46 views

What is the RFC order of peer certificate verification, trust chain or expiry first?

If a certificate received from a peer: Is expired, has a valid signature, but from an untrusted root CA What error should be thrown? Untrusted certificate or expired certificate? I can't seem to ...
1
vote
1answer
39 views

ECDSA over $\mathbb{F}_{p^n}$ for $n>1$. How to calculate $r$ and $s$

I'm having some trouble understanding how to calculate $r$ and $s$ as specified in the wikipedia page for ECDSA (https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm) We can see ...
0
votes
2answers
48 views

cryptographically signed streaming data

On a high level the question is: how does one cryptographically sign streaming data? Here is the context: a number of people are continuously streaming data to me the data is public and does not ...
1
vote
0answers
66 views

Overcome MD5-RSA Signature verification

I asked this question already at the Information Security SO site, but my research on how to overcome this problem ended always on the crypto site. That's why I will try to find some help here :) I ...
0
votes
0answers
61 views

Choosing K in ECDSA SECP256K1

I am working on a very resource-constrained environment. Using a standard peer reviewed library isn't possible because it won't fit within the RAM requirements of the device (~5K unused ram without ...
2
votes
1answer
93 views

DSA: why using mod p mod q and not just mod p

I'd like to know, in DSA we compute several values modulo $p$ and modulo $q$, like $r = (g^k \bmod p) \bmod q$ or $v = (g^{u_1}h^{u_2} \bmod p) \bmod q$. As far as I understand, we want to use two ...
2
votes
1answer
142 views

Why is encryption slower than decryption in elliptic curve cryptography (ECC)?

While performing encryption using public key and decryption using the private key, I am always finding that encryption takes more time than decryption in elliptic curve cryptography (ECC). It's the ...
0
votes
0answers
50 views

RSA Signature Forgery - Low Public Exponent + Improper Padding Validation? [duplicate]

Consider the following custom crypto: We have a signed message M1 with corresponding signature S. We have the 1024-bit modulus <...
0
votes
0answers
37 views

Are there any multi-signature scheme used in IoT?

I have searched on Google the keywords "multi-signature, IOT", but it seems that not many papers related to that have been proposed. What I found most is related to blockchains. My motivation is, in ...
0
votes
2answers
497 views

What is the difference between RSASSA-PSS signing and RSA-PSS signing?

I read the RFC 8017 and understood the pkcsv1.5 and pss padding techniques. I understood that in RSASSA-PSS signing scheme the signature will be appended at the end of M. In some websites I read both ...
-1
votes
1answer
114 views

What are the inverse operations in elliptic curve cryptography?

Public-private key cryptography is based on inverse operations that use separate input. In elliptic curve cryptography, what are those inverse operations?