Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [signature]

Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

0
votes
0answers
16 views

One way function from Signature scheme

How to generically construct one way function from any signature scheme?
1
vote
1answer
30 views

Private key not used in a signature scheme

I'm trying to understand the following signature scheme (Camenisch-Lysanskaya): Key generation: $n = pq$ special RSA modulus, $a, b, c \in QR_n$. $PK = (n, a, b, c), SK = p$. Signing algorithm: $m$ ...
3
votes
1answer
62 views

Comparison of security definitions for signatures

The two main security definitions for signatures are EUF-CMA and the strong version of it sEUF-CMA. What I see that their difference is that in EUF-CMA experiment, the adversary needs to produce a ...
4
votes
1answer
80 views

Are commutative digital signature possible?

Say we have a message $m$. Signer $S^1$ will sign this message using his digital signature to produce: $$\operatorname{Sign}_{S^1}(m)$$ Now, say another signer $S^2$ wants to sign the output of the ...
0
votes
0answers
36 views

Prove that a given signature scheme is secure under random message attacks

This is a follow up to my previous question. Consider the following signature scheme: $\operatorname{KeyGen} (1^k$) : On input of a security parameter $k$, choose a symmetric bilinear group with $...
0
votes
0answers
27 views

Prove that a signature scheme is RUF-NMA and not EUF-CMA

I am working on the following exercise: Now, assume the following signature scheme: $\operatorname{KeyGen} (1^k$) : On input of a security parameter $k$, choose a symmetric bilinear group with ...
0
votes
0answers
22 views

How to use Windows User Certificate (S/MIME) to sign data [migrated]

I am working on an internal ERP for my company. The portal is written in PHP and the current purchasing process is the following: Create a new order on the ERP portal Print the order (PDF) Ask for ...
3
votes
1answer
274 views

Is there a symmetric-key algorithm which we can use for creating a signature?

I know that in the asymmetric-key algorithm the RSA signature exists but what about the symmetrical ones?
2
votes
2answers
109 views

Would a HMAC digest make sense in an RSA / ECDSA signature?

When MD5 and SHA1 were broken there was, each time, a scramble to upgrade software and certificates to remove the offending algorithm. However, in each case, the HMAC variant of each hash function was ...
0
votes
2answers
74 views

Why doesn't the formula work when checking two ECDSA signatures?

There are two generated ECDSA signatures X - Private key S = ((Z + (X * R)) / K) mod n S` = ((Z` + (X * R`)) / K`) mod n G - Base point, of order n; ...
3
votes
2answers
91 views

Which hash is used when providing signature algorithm ED25519 or ED448?

From TLS 1.3 there are two signature algorithms using edDSA: /* EdDSA algorithms */ ed25519(0x0807), ed448(0x0808), All the other signature-...
1
vote
1answer
26 views

Where can I find the standard definition for GPG ECDSA signature?

I am playing around with GPG which I'd like to use to sign an integer and use the resulting signature binary in another piece of code. So far I have created a simple PGP packet parser with which I ...
1
vote
3answers
106 views

Digital Signature Algorithm for large files - bottle-necked by hash function?

I am new to studying digital signatures like ECDSA and EdDSA, and was curious about something. Lets say hypothetically I want to create a digital signatures of millions of files, with a total size of ...
0
votes
1answer
32 views

PKCS#10 why keeping the Subject Public Key in the X.509 Certificate

In the pkcs#10 workflow to obtain the x.509 certificate used in digital signature, in the Certificate Request Information, itself in the CSR, we have the Subject Public Key. That Subject Public Key ...
2
votes
1answer
71 views

Generating a key pair using a signature generated by an existing key

I’ve built an app in which each user has a private/public key pair and I want to generate a second one for them, however I cannot store the second private key anywhere. What would be the drawbacks ...
2
votes
1answer
75 views

Generating a small EDDSA curve

I have an application that would benefit from very small (e.g. 16-20 byte) EDDSA keys and small signatures. It's an application where the goal is more to deter DOS attacks than "hard" security, so ...
0
votes
1answer
38 views

Using the same RSA key for verifying a website and digital signature

We have the (same) RSA key for verifying a website and for digital signature. A user would send a nonce encrypted using the public key, the websites returns the nonce by decrypting it using the ...
2
votes
1answer
60 views

How to identify RSASSA-PSS from rsaEncryption OID?

Following the RFC 8446 it states that: RSASSA-PSS RSAE algorithms: Indicates a signature algorithm using RSASSA-PSS [RFC8017] with mask generation function 1. The digest used in ...
4
votes
2answers
502 views

How can I hash an input into an arbitrary domain point?

I am trying to implement a signature scheme involving RSA signing of a message digest generated by SHA-$256$. I want to hash the input into an RSA domain point instead of the fixed $256$ bit digest ...
6
votes
1answer
91 views

Is it important to defend against key substitution attack in ECDSA?

When planning a file signature scheme (basically, just to sign all files content). Is it obligatory to defend against ECDSA key substitution attack? ISO/IEC 14888-3:2018 NOTE 5 states: The ...
2
votes
1answer
66 views

Is padding of the digest needed in SHA256 with RSA-2048 scheme?

For a signing scheme involving generating a $256$ bit digest using SHA256 followed by RSA with $2048$ bit modulus, the signature would always be 256 bit without padding even though sigantures of up to ...
1
vote
0answers
25 views

Non-Repudiation vs Identity-Binding

There are 3 properties offered by a cryptographic digital signature scheme: Integrity guarantee of the message signed. Authenticity guarantee of the message signed. Non-repudiation of the message ...
2
votes
2answers
94 views

How do I create a cryptographic signature and commitment scheme with accountable evidence?

This is a weird one... I am looking for a method which I don't even know how to call, nor whether it actually exists! Given a pair of asymmetric keys $s_{k}/P_{k}$ and defining $Sig_{k} \dagger B_{i}$...
3
votes
2answers
58 views

What is the point of separate links to the download and its digital signature

I see a statement like this on a product's download page: "The signature for setup-x86.exe can be used to verify the validity of this binary using this public key." where each this above is a ...
6
votes
5answers
1k views

What is the point of digital signatures if confidentiality is violated?

Lets say we use RSA as the signature method. Alice wants to send a message to Bob and uses RSA signing. For that she signs her message with her private key. But everybody could now have access to her ...
1
vote
0answers
29 views

Confirmation signature - Improved Feldman VSS

I am working through the implementation of A Distributed Private-Key Generator for Identity-Based Cryptography. In the paper (Figure 1, page 8) the validation of a share by a node says that once ...
1
vote
0answers
55 views

Schnorr-signature calculating a coefficient

I need to create program that makes signature for selected file. I simplified algorithm a little, because I draw max 64 bit prime numbers instead of ...
2
votes
1answer
187 views

How does openssl signature verification work?

I would like to know how openssl verifies a digital signature? I know that it uses this command to verify a signature: ...
1
vote
0answers
31 views

Temporal or spatial digital signatures

Digital signatures allow authentication of content based on a secret held by the signing entity. Are there any existing schemes, proposals or even services for letting "location" or "time" sign the ...
4
votes
0answers
65 views

Which organization is responsible for certifying a TSA?

I see there a number of free TSA services according to this page (not all are still in service). In other sources I see references to the requirement of audits for the TSA to be 'rfc3161 compliant'. ...
1
vote
0answers
24 views

What is the smallest size of CAdES signature?

CAdES signatures are usually huge, they contain certificates, possible full chain, and even source data enveloped in it. This is very impractical if we want to sign every file in the system for ...
0
votes
1answer
43 views

Efficient Aggregate Signatures With Same Key

Suppose Alice has a set of messages $\mathcal M$ and generates signature pairs for each message $(m_1,s_1)$, $(m_2,s_2)$, ... $(m_n,s_n)$ using the same key. She then transfers these signature pairs ...
1
vote
0answers
49 views

Could you design something like a ring signature that uses website accounts instead of keys?

Ring signatures allow one to prove that you own a private key corresponding to a public key from a set of keys, without revealing which private key you control. This is useful if you are part of some ...
1
vote
2answers
40 views

Is there any way to check signed documents in a group of people without knowing who signed which?

Let's say there are 3 people A, B, C. Everybody knows their public keys. They sign documents/messages and normally we can know who signed which by checking with their public keys. Is there any way to ...
-1
votes
1answer
111 views

How does Diffie Hellman protocol work in Bitcoin Blockchain Transactions?

Greetings to all! Please explain how the Diffie-Hellman protocol works in Bitcoin? That is, in Blockchain Transactions, there is also a total number of "K" recipient and sender? "K" the recipient and ...
3
votes
1answer
89 views

Generating RSA signature, by manipulating shorter message signatures?

Given a server that can return me RSA sign for any plaintext shorter or equal length of the given plaintext (excluding the given plaintext), how can I fraud/get the sign of the given? $$sign = M^{d} \...
1
vote
1answer
92 views

Message authentication vs entity authentication

Does message authentication authenticate the entity? If the answer is "No", because message authentications like MAC work with the shared symmetric key, then my second question is: Does a message ...
1
vote
1answer
75 views

Comparable or partially homomorphic public key derivation for signatures?

Are there any public key signature schemes that can be compared blindly or partially homomorphically based on the private key without knowing the private key? Example: let's say I derive a public key ...
2
votes
2answers
95 views

Why Random Secret Necessary Almost in all digital Signature Algorithms

I've read some introduction documents about digital signatures, and all they said is Signer calculates a hash of data to be signed. This hash is encrypted with the private key. Verifier reads the ...
1
vote
1answer
63 views

Digital signature

I learned that a digital signature is encrypted using private key and is decrypted using public key. How does the verifier gets the public for verifying the signature? If a person has to request ...
3
votes
1answer
95 views

Security of Fast Two-Party ECDSA Signing

The paper "Fast Secure Two-Party ECDSA Signing" by Yehuda Lindell describes a system in which two parties, $P_1$ (with 1/2 of a share of a long-term ECDSA signing key $x_1$) and $P_2$ (with the other ...
0
votes
1answer
73 views

How to break RSA signature on XOR of hashed blocks

I'm trying to figure out if there's a way of breaking or weakening the following method of signing long messages Given $M=m_{1}m_{2}...m_{n},\,\,|m_i|=64b, \,\,h=h(m_{1})\oplus h(m_{2})\oplus\cdots\...
1
vote
0answers
50 views

Is it necessary to transmit two or three points of an elliptic curve?

Are there cryptographic protocols, where a party should transmit by communication channel simultaneously two or three $\mathbb{F}_q$-points of an elliptic curve over a finite field $\mathbb{F}_q$? ...
0
votes
1answer
41 views

Help understanding lattice-based aggregate signature scheme

I came across this paper about aggregate lattice-based signatures, however, I'm not able to fully understand it. Specifically, I'm wondering if someone could help answer the following questions: In ...
0
votes
2answers
72 views

Does this pairing-based signature scheme work?

Suppose $g$ is a pairing-friendly elliptic curve with subgroup generators $G_1$ and $G_2$. Suppose also that $M$ is the message I want to sign. Setup Compute $A = a \cdot G_1$ and $P = p \cdot G_2$, ...
2
votes
1answer
64 views

Does this simple signature scheme work?

Let's say my public key is defined as $P = p \cdot G$, where $p$ is my private key and $G$ is a generator point of an elliptic curve. If I wanted to sign a message $m$, could I do the following? Hash ...
1
vote
1answer
125 views

Can a TLS certificate using ECC secp384r1 as PK algorithm uses RSA for signature

If a TLS certificate public-key algorithm is ECC secp384r1 or ECC prime256v1, is it possible to have RSA as a signature ...
1
vote
1answer
234 views

What is the recommended minimum key length for ECDSA signature

I want to identify the proportion of certificates that use unrecommend ECDSA key length for TLS certificates based on some data I collected. By looking at a standard like NIST for example, I find ...
0
votes
1answer
84 views

Does RSASSAPSS use RSA signature

I just need to know is it correct to classify the RSASSAPSS scheme and sha[256 | 512 | 1]WithRSAEncryption all under RSA ...
5
votes
2answers
98 views

Why ECDSA has its form?

According to Wikipedia, if Alice wants to sign some message, she computes $s = k^{-1} (z + r d_A)$ then sends $(r, s)$ to Bob. I don't understand why they use this particular formula $s = k^{-1} (z + ...