Questions tagged [signature]

Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

Filter by
Sorted by
Tagged with
0
votes
0answers
15 views

How to verify signature of .asice container (ecdsa-sha256) via command line or API?

File: https://cdn.discordapp.com/attachments/691402249586343946/697033738097262602/wallet.txt Signature container: https://gateway.pinata.cloud/ipfs/QmVFST2tbVR6bokaMYXPxJJQXELwLfqWSrRaBgZqwaQT7Y ...
1
vote
1answer
30 views

How do the signatures or message authentication codes achieve the authenticity, integrality or non-repudiation?

Actually, I want to know whether there are explicit and formal definitions of the properties which are authenticity, integrality or non-repudiation. It seems that the signatures and MACs can achieve ...
1
vote
0answers
31 views

The following exercise is given in our book and I don't know how to solve it. Could somebody show me how to do it?

$\textbf{13.10 (Probabilistic full domain hash).}$ Consider the following signature scheme $\mathcal{S} = (G,S,V)$ with the message space $\mathcal{M}$, and using a hash function $H: \mathcal{M} \...
1
vote
2answers
46 views

How to properly sign and verify using DSA? Can anyone spot my mistake?

The question that I am trying to answer is as follows: 10.14. The parameters of DSA are given by p = 59,q = 29,α = 3, and Bob’s private key is d = 23. Show the process of signing (Bob) and ...
0
votes
0answers
24 views

Implementing ESignature and digital certificate

I'm having some issue understanding the mechanism of electronic signature and how implementing it Here what I understood, correct me if I'm wrong: (Client is here an android or ios device. Server ...
2
votes
1answer
56 views

Verify ECDSA signature without data

With RSA PKCS#1 v1.5 it is possible to verify that the signature was generated by the correct private key without actually having access to the data. You just perform the modular exponentiation with ...
0
votes
1answer
31 views

ECDH Public Key Recovery - Determine if valid key exists from just signature and message

If I have just the (r,s,v) values of the signature and the message hash, what is the most efficient way to determine if a valid public key exists? I do not need to know the public key, just that the ...
1
vote
0answers
32 views

Very simple way of verification

In an application we need some way for a user to authenticate, but have the challenges of very restricted functions to use. Each user has got a 16bit-number he can't change. We want to calculate some ...
0
votes
0answers
18 views

HSM: How multiple users are supported (using SAM)? [closed]

So far, I knew that traditional HSMs (Hardware Security Module) can be used to store key of a single user. But, recently, I came to know that newer HSMs have the capability to store keys of multiple ...
0
votes
0answers
28 views

Relation between signature size and message-digest length in RSA PKCS#1v1.5 sign/verify

When using RSA-PKCS#1v1.5 to sign and verify a message-digest, is there a compulsory relation between the sizes of message-digest and the key/signature ? For example, If I use key/signature length of ...
1
vote
0answers
31 views

Regarding security of blind signature schemes

I'm new to blind signatures, trying to understand security notions of it: blindness and one-more unforgeability. I found out that in the security game for blindness property, the adversary $\mathcal{...
8
votes
1answer
741 views

RFC6979: error in reference implementation?

If I correctly understand RFC 6979, there is an error in the ref implementation section 3.2. In the step H2, RFC specification says ...
1
vote
0answers
37 views

Best practice to hash multiple attributes

I have to generate a signature for concatenation of multiple independent values say A | B | C. Two options are : concatenate all attributes and generate the hash. Then Sign hash. $$ signature = Sign\...
1
vote
1answer
45 views

Difference between DER encoded signatures in JavaScript, Java, and C++

I'm trying to understand the DER-encoded signatures for the secp256k1 (ECDSA) curve better, so I have the following data array: 000102030405060708090a, which is a ...
1
vote
2answers
80 views

What's the actual difference between RSA encrypting and Descrypting and RSA Signing? [duplicate]

this question arised because I'm working with Windows' CNG library and it has 4 functions for RSA: BCryptEncrypt (private key, message) BCryptDecrypt (public key, message) BCryptSignHash (private key,...
0
votes
0answers
30 views

Comparisons of ECDSA, EdDSA and BLS Signatures in Blockchain: Pros and Cons

As we know, the most used digital scheme in Blockchain is ECDSA. For now, more and more blockchain projects, I've noticed, are considering substituting EdDSA and BLS signature scheme as the new one. ...
1
vote
0answers
19 views

Is there a fast signature scheme homomorphic over $GF(2^b)$ with $b > 1$?

Is there a signature scheme that given $x, y \in \mathbb{Z}_p^k$ and signatures $S(x)$ and $S(y)$ allows any linear combination of $x, y$ to be successfully verified, and nothing else? I'm aware of ...
1
vote
1answer
83 views

Is it possible that a signing algorithm produces no output?

I am reading Vadim Lyubashevsky's paper on Lattice Signatures without Trapdoors and I came across a somehow counter-intuitive part where he defined an algorithm $\mathcal{A}$: $y\leftarrow D_\sigma^m$...
2
votes
1answer
69 views

What are the implications of limiting the private key space with elliptic curve Schnorr signatures?

Given a curve, I am trying to limit the private key space to ultimately cut down the Schnorr signature size as follows: Assume an elliptic curve $E$ over a field $F$ with generator point $G$ and the ...
0
votes
0answers
26 views

Understanding signature length computation

In the following paper, the authors provide a lattice-based ring signature from a 1-out-of-N proof, copied below. They illustrate their discovery with a table on the bottom of page 28, summarizing ...
1
vote
1answer
26 views

Binary verification of application image before loading it into DRAM

Working on a boot process where the application image has to be verified before loading it into DRAM. We found 2 strategies; RSA-1024, where the private key is secure in premises and the only public ...
1
vote
1answer
63 views

Is there an asymetric encryption whos output size is quite equal to the input size

I want to verify, that a chunk of data which has a size of around 16 bytes is sent by me, by simply encrypting it via a private rsa key, providing the public key in the source code for the ...
2
votes
0answers
38 views

Errors in the RingCT 3.0 paper

I found some errors in the RingCT 3.0 paper (https://eprint.iacr.org/2019/508.pdf) in the ring signature chapter. This makes it impossible to implement this algorithm. Namely: In the chapter “C.2 ...
2
votes
1answer
123 views

Does the authenticity of messages by Alice still holds if the state of bob is compromised in Double Ratchet

In the double ratchet algorithm, let's say if bob's device is compromised including his long term key. Does the ephemeral keys generated by Alice during the half Diffie–Hellman key exchange produces ...
5
votes
0answers
54 views

Is it possible to derive a homomorphic signature from homomorphic encryption

At the moment I am trying to find a practical way to implement a linearly homomorphic signature. Background: "In a homomorphic signature scheme, a user Alice signs some large dataset x using her ...
1
vote
2answers
97 views

SHA-3 for Integrity

We used to use CRCs to check the integrity of files. For safety analysis we could associate a probability for detecting a corrupted bit in a large file. Now we are using an RSA Signed SHA-3 hash for ...
7
votes
1answer
1k views

Existential unforgeability vs strong unforgeability

In the article https://crypto.stanford.edu/~dabo/pubs/papers/strongsigs.pdf there are two definitions for the security of a digital signature scheme: existential unforgeability and strong ...
2
votes
2answers
81 views

Is there a cryptographic primitive that allows “signature chaining”?

Let's assume that a digital signature scheme $S$, which is secure against existential forgery under adaptive chosen message attack, can only be used with fairly short signature inputs, i.e. $S(sk, m)$ ...
1
vote
1answer
100 views

Use of crypto on QR codes for access control [closed]

I want to create a process whereby registered users receive a QR code on their phone and then they present this code to a camera. The camera should scan the QR code and then decide if the QR code is ...
5
votes
1answer
121 views

Protecting Ed448 against DPA and fault attacks

There are some papers (1, 2) describing fault attacks in EdDSA. One suggested countermeasure is to add randomness to the input of the first hash call, which outputs a scalar. This paper describes a ...
2
votes
1answer
72 views

Why ElGamal signature is insecure with nonrandom k?

In ElGamal signature scheme like: Keygen: $\beta:=\alpha^a\bmod p$ where $\alpha$ and $p$ are large prime numbers. Public key is $(p,\alpha,\beta)$ and secret key is $a$. Sign: Choosing random $k$ ...
1
vote
1answer
59 views

Winternitz One Time Signature

I happened to watch Mr. Bill Buchanan lecture that explains Winternitz one time signature scheme (https://www.youtube.com/watch?v=eqMMlcN4zSc). The scheme shown in the lecture is susceptible to ...
1
vote
1answer
50 views

What's the difference between threshold signatures and multisignatures?

I was wondering what's the difference between threshold signatures and multisignatures. In what respects do they differ? For example, is n-out-of-n threshold signature, just a multisignature?
1
vote
1answer
81 views

RSA signing - does EMSA-PKCS1-v1_5 padding need to be verified?

I am working with an embedded system that accepts firmware updates only if they are validly signed by a particular 2048-bit RSA private key (the embedded system's bootloader knows the corresponding ...
1
vote
1answer
37 views

Difference between Verification and Public Key for Signature Schemes

This is a semantics Question. Typically, in many asymmetric schemes, for this question specifically, digital signatures, we see that designers describe the key given to the verifier as Public Key. ...
1
vote
2answers
73 views

Secure implementation of public key cryptography

Reading online I've found out that for example the RSA implementation that you usually find on textook is not secure. Where I can find some secure implementation of algorithm such as RSA, ECDH, ECDSA? ...
0
votes
0answers
43 views

Can knowing the ephemeral key recover the private key in ECDSA

If the attacker - some guy who really, really wants to steal bitcoins - somehow finds the ephemeral key used in an 256-bit ECDSA signature, can he recover the private key? If so, would knowing the ...
3
votes
3answers
185 views

How do I verify a message came from me?

I have many clients and a single server, and on each of these clients I want to be able to verify a message did indeed come from my server. My idea was to send some sort of key with cryptographic ...
-2
votes
1answer
86 views

RSA - Compute signature

I have a question in (textbook) RSA. Suppose we have two public keys $pk_1=(e_1,N)$ and $pk_2=(e_2,N)$ (with $\gcd(e_1,e_2) = 1$). Assume that there are $\sigma$,$\sigma'$ such that $\sigma$ and $\...
2
votes
1answer
128 views

Which padding is used for sha256WithRSAEncryption (1.2.840.113549.1.1.11), deterministic or random?

Questions Is the only way to know which padding was used is to know the context of how sha256WithRSAEncryption was used (that PS is 0xFF when signing, and random non-zero when encrypting)? Is there ...
8
votes
2answers
1k views

Why does SSH authentication protocol send a challenge message instead of using digital signature to verify client

Why does SSH authentication protocol choose to have the server with the public key send a challenge message encrypted with this public key of the client instead of having the client send a message ...
0
votes
0answers
17 views

Code for linkable ring signatures with sublinear size

I am looking for a working code of linkable ring signatures with sublinear size (a root or better a logarithm of the ring size.) I mean, the list of public keys can be public and not taken into ...
0
votes
1answer
85 views

Forging Rabin signature

What is the chances to forge a signature for the system implementing Rabin signature with total message recovery, if attacker posses the public key and have some message pairs? The last byte of ...
-2
votes
1answer
69 views

ECDSA multiplication vs exponentiation

In Elliptic Curve Digital Signature Algorithm (ECDSA) I often see 2 different written equations of it: Elliptic curve point multiplication by a scalar, $Q_{A}=d_{A}\times G$, source Modular ...
1
vote
0answers
36 views

Verify XML digital signature

I'm trying to figure out how to verify an XML digital signature. I have received a signed XML response (in string) in following format: ...
3
votes
1answer
132 views

Forgery against signature using RSAES-PKCS1-v1_5 padding

I wonder what is the security of RSAES-PKCS1-v1_5 under chosen-plaintext attack, in the context of signature verification. Notations. Let $(N,d)$ be an RSA signing key, and $(N,e)$ the corresponding ...
2
votes
1answer
38 views

Signature over MAC value for a random key

Would it be possible to create a signature scheme like this: $ \DeclareMathOperator{Gen}{Gen_{\Mac}} \DeclareMathOperator{Mac}{Mac} \DeclareMathOperator{Sign}{Sign} \DeclareMathOperator{F}{F} \...
5
votes
1answer
1k views

Is there asymmetric encryption in SSH?

I've read in DigitalOcean article about SSH that in order for a server to authenticate a client: The server sends the client this encrypted message. If the client actually has the associated ...
1
vote
1answer
75 views

Is there value in performing signature during key exchange?

I looked around the net, however I couldn't see anything authoritative on this. If one is using something like libsodium to perform key exchange (using x25519), is there value in using Ed25519/...
2
votes
1answer
49 views

What is the standard way to generate a unique non-reproducible ID?

Say that a manufacturer wants to label her products in such a way that a third party could verify that the manufacturer is the one that labeled the product, meaning it's not a counterfeit. The ...

1
2 3 4 5
20