Questions tagged [signature]

Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

Filter by
Sorted by
Tagged with
1
vote
1answer
51 views

RSA signing - does EMSA-PKCS1-v1_5 padding need to be verified?

I am working with an embedded system that accepts firmware updates only if they are validly signed by a particular 2048-bit RSA private key (the embedded system's bootloader knows the corresponding ...
1
vote
1answer
29 views

Difference between Verification and Public Key for Signature Schemes

This is a semantics Question. Typically, in many asymmetric schemes, for this question specifically, digital signatures, we see that designers describe the key given to the verifier as Public Key. ...
1
vote
2answers
64 views

Secure implementation of public key cryptography

Reading online I've found out that for example the RSA implementation that you usually find on textook is not secure. Where I can find some secure implementation of algorithm such as RSA, ECDH, ECDSA? ...
0
votes
0answers
33 views

Can knowing the ephemeral key recover the private key in ECDSA

If the attacker - some guy who really, really wants to steal bitcoins - somehow finds the ephemeral key used in an 256-bit ECDSA signature, can he recover the private key? If so, would knowing the ...
3
votes
3answers
122 views

How do I verify a message came from me?

I have many clients and a single server, and on each of these clients I want to be able to verify a message did indeed come from my server. My idea was to send some sort of key with cryptographic ...
-2
votes
1answer
84 views

RSA - Compute signature

I have a question in (textbook) RSA. Suppose we have two public keys $pk_1=(e_1,N)$ and $pk_2=(e_2,N)$ (with $\gcd(e_1,e_2) = 1$). Assume that there are $\sigma$,$\sigma'$ such that $\sigma$ and $\...
2
votes
1answer
66 views

Which padding is used for sha256WithRSAEncryption (1.2.840.113549.1.1.11), deterministic or random?

Questions Is the only way to know which padding was used is to know the context of how sha256WithRSAEncryption was used (that PS is 0xFF when signing, and random non-zero when encrypting)? Is there ...
8
votes
2answers
1k views

Why does SSH authentication protocol send a challenge message instead of using digital signature to verify client

Why does SSH authentication protocol choose to have the server with the public key send a challenge message encrypted with this public key of the client instead of having the client send a message ...
0
votes
0answers
16 views

Code for linkable ring signatures with sublinear size

I am looking for a working code of linkable ring signatures with sublinear size (a root or better a logarithm of the ring size.) I mean, the list of public keys can be public and not taken into ...
0
votes
1answer
77 views

Forging Rabin signature

What is the chances to forge a signature for the system implementing Rabin signature with total message recovery, if attacker posses the public key and have some message pairs? The last byte of ...
-2
votes
1answer
58 views

ECDSA multiplication vs exponentiation

In Elliptic Curve Digital Signature Algorithm (ECDSA) I often see 2 different written equations of it: Elliptic curve point multiplication by a scalar, $Q_{A}=d_{A}\times G$, source Modular ...
1
vote
0answers
27 views

Verify XML digital signature

I'm trying to figure out how to verify an XML digital signature. I have received a signed XML response (in string) in following format: ...
3
votes
1answer
103 views

Forgery against signature using RSAES-PKCS1-v1_5 padding

I wonder what is the security of RSAES-PKCS1-v1_5 under chosen-plaintext attack, in the context of signature verification. Notations. Let $(N,d)$ be an RSA signing key, and $(N,e)$ the corresponding ...
1
vote
1answer
32 views

Signature over MAC value for a random key

Would it be possible to create a signature scheme like this: $ \DeclareMathOperator{Gen}{Gen_{\Mac}} \DeclareMathOperator{Mac}{Mac} \DeclareMathOperator{Sign}{Sign} \DeclareMathOperator{F}{F} \...
5
votes
1answer
1k views

Is there asymmetric encryption in SSH?

I've read in DigitalOcean article about SSH that in order for a server to authenticate a client: The server sends the client this encrypted message. If the client actually has the associated ...
1
vote
1answer
71 views

Is there value in performing signature during key exchange?

I looked around the net, however I couldn't see anything authoritative on this. If one is using something like libsodium to perform key exchange (using x25519), is there value in using Ed25519/...
2
votes
1answer
45 views

What is the standard way to generate a unique non-reproducible ID?

Say that a manufacturer wants to label her products in such a way that a third party could verify that the manufacturer is the one that labeled the product, meaning it's not a counterfeit. The ...
0
votes
1answer
360 views

“Probability” of an ECDSA signature

The article Elliptic Curve Digital Signature Algorithm in Bitcoin's wiki talks about signatures having probabilities (as in ...
1
vote
0answers
41 views

Does EdDSA share Schnorr signature secure linearity property?

EdDSA, Edwards-curve Digital Signature Algorithm (EdDSA) is a digital signature scheme using a variant of Schnorr signature based on Twisted Edwards curves (source). Schnorr signatures have a ...
2
votes
1answer
37 views

Non Repudiation - Message Authentications methods

According to a definition given by my professor: Message authentication methods verify that the message is from the right sender, however they don't guarantee non-repudiation. To me this sounds ...
1
vote
2answers
82 views

Difference between Tag and Signature

Is there a technical difference between tag such as tag generated by authenticated encryption, and signature such as the signature generated by a functional signature scheme or homomorphic signature ...
2
votes
1answer
58 views

What is the main difference between Unique signature and Verifiable Random Function?

The output of VRF contains two parts, the first is the output of the VRF hashing and the second is the proof of correctness. In a unique signature scheme, the signature also contains two parts which ...
1
vote
0answers
54 views

Why group signature based CL signature is in “sign-encrypt-prove” paradigm

In this paper, it referred that there are two paradigms used in constructing group signatures: the "sign-encrypt-prove"(SEP) paradigm and "sign-randomize-proof"(SRP) paradigm. As said in this paper, ...
2
votes
1answer
222 views

What happens when i sign a public key with its private key pair?

I am not a cryptologist, just a cryptography user, so not sure if this is safe. I want to sign a public key with its private key pair. Is it dangerous to share this signature result along with ...
0
votes
1answer
73 views

Input Hash Size of ECDSA Signature over Curve secp521r1

For encryption authentication, I am using ECDSA signatures over the curve secp521r1. There is a hash function parameter, and as the curve is 521-bit, the hash output length should be > 512 bits, which ...
0
votes
0answers
23 views

Distributed group signature scheme

Since there is only one group manager in group signature scheme, are there any scheme that have n group managers who pubilish the member private key or member credential together(or like threshold ...
1
vote
1answer
54 views

Elliptic curve one time signatures

This is kind of an academic question, but I wonder if it's possible to build an intentionally one-time signature scheme with elliptic curves? I assume you could do it by supplying ECDSA with ...
3
votes
1answer
139 views

Is ECDSA signature strongly EUF-CMA?

I read, here, that ECDSA signature is EUF-CMA but not SUF-CMA, aka sEUF-CMA (for strong existential unforgeability under adaptively chosen message attacks; see terminology there). Specifically, the ...
1
vote
1answer
44 views

Is this API for ECDSA signature verification consistent with NIST test vectors?

I'm trying to use code from "Easy ECC" package (a github project), for ECDSA-verifying a signature. The problem I'm facing is that the API assumes a public key length of N+1, which is different than ...
0
votes
0answers
29 views

Implemetation of a Sigma Protocol for a paper “Anonymous Identification in Ad Hoc Groups, 2004”

I read the paper Anonymous Identification in Ad Hoc Groups, 2004 Dodis et. al. My understanding is that it basically generates a group public key, whose identity can be controlled (to verify ...
0
votes
0answers
43 views

Digital signature forging on a server, after entity authentication [duplicate]

Lets assume there is a guy called Ben, he contacts some server for a ticket number and the server returns a random number to him. Ben then signs that number and sends it back to the server, which ...
1
vote
1answer
188 views

Getting unlimited amount of signatures - Risk?

Lets suppose we have a communication protocol given where messages $(1)$ and $(2)$ are send over an unsecure network. There are some prerequisites like distributed certificates etc., but they should ...
0
votes
0answers
42 views

Signing files with some kind of “inheritance”

I'd like to design a system where the following situation happens: I (person 1) have some secret key I hand out another secret key to a developer (person 2) Person 2 signs several files with his ...
0
votes
0answers
52 views

Possible to convert PGP ed25519 signature into signify-compatible format?

Both PGP and Signify (or Minisign) are capable of generating ED25519 detached signatures. Is it possible to convert a PGP-generated ED25519 signature into a signify-compatible format?
3
votes
0answers
67 views

Using (EC)DH to generate a signature

Say I have access to a system A that is limited to performing (EC)DH, followed by key derivation to produce a secret key. This secret key is later used to provide integrity protection. There is a ...
2
votes
0answers
36 views

Post-quantum aggregate / multi signatures

Are there any practical post-quantum aggregate / multi signatures? Currently, the aggregate / multi signature schemes seem to be limited to pre-quantum elliptic curve assumptions only, e.g., [BDN18], [...
3
votes
1answer
129 views

Using ePassport with Active/Chip Authentication to sign documents

I'm a complete newby, so please pardon my ignorance when it comes to basic cryptography aspects. My question is whether a biometric passport with Active/Chip Authentication (AA or CA) can be used to ...
0
votes
0answers
46 views

How to validate the authenticity and integrity of an XML document?

I am working on a C++ desktop application that reads an XML (also created by my org) from a public server (does not require authentication). I would like to make sure that the downloaded XML has not ...
0
votes
1answer
42 views

Can I use a government-issued certificate in Outlook? [closed]

My government issues certificates for many purposed, including e-mail signing. The government doesn't provide e-mail addresses, but it does declare my e-mail in the certificate. Can I use this ...
1
vote
1answer
25 views

Group Signatures with VLR Revocation Check

I was reading the paper by Boneh et al. Link. The scheme describes what is called a Verifier Local Revocation Technique. The Scheme assumes that a Revocation List [RL] allows each verifier to check ...
1
vote
1answer
99 views

Can we use BLS as a VRF?

Intuitively, it seems that the hash of a BLS signature could be used as a VRF as well. In a nutshell, BLS-Signature is the VRF output and the verification first ...
2
votes
0answers
52 views

What are some use cases for white-box digital signatures?

There were 2 papers published in the last year, that describe 2 different white-box identity-based digital signature schemes: White-Box Implementation of the Identity-Based Signature Scheme in the ...
0
votes
1answer
37 views

Signing data packets increases data size too large for packet to contain

In a setup where the client signs then encrypts outgoing data packets to a VPN server / onion network, an ECDSA signature appended to the plaintext before encryption could cause the data to be too ...
0
votes
1answer
72 views

How to check runtime of e.g. Ed25519 signature algorithm

As mentioned here the verification of a Ed25519 signature takes roughly 3 times as the time for the generation of a signature. Two questions on that: 1) Can I assume that this is a rule of thumb for ...
0
votes
0answers
86 views

Encoding function for ISO 9796-2

I try to reproduce the analysis conducted in this presentation by R. Lifchitz. Namely, data signed by an 1024-bit key $n$ (Rabin scheme) and following ISO/IEC 9796-2. From what I understand, for a ...
1
vote
0answers
25 views

Does a digital signature algorithm exist which has a normal, a blind, an elliptic curve and an elliptic curve blind version?

Q: Does a digital signature algorithm exist which has a normal, a blind, an elliptic curve and an elliptic curve blind version? I am searching for an algorithm where you can see what happens if you ...
2
votes
1answer
349 views

How android apk file signing works?

There are a number of pages on web to tell how to sign apk file for Android. But none I've found telling how it works under-the-...
2
votes
1answer
115 views

Proof of application of $f(x)$ without disclosing input $x$

I have three nodes in a network: $\mathcal{S}$,$\mathcal{T}$,$\mathcal{R}$. $\mathcal{S}$ supplies data $x$ to $\mathcal{T}$. $x$ is signed so $\mathcal{T}$ knows it actually comes from $\mathcal{S}$...
2
votes
1answer
103 views

What is Reverse Trapdoor Function?

In wikipedia on Digital_signature: but rather, the message to be signed is first hashed to produce a short digest, that is then padded to larger width comparable to N, then signed with the ...
0
votes
0answers
40 views

Relationship between special RSA modulus and quadratic residue in CL (Camenisch-Lysyanskaya) signature

I'm studying the CL(Camenisch-Lysyanskaya) signature (A signature scheme with efficient protocol proposed by Camenisch-Lysyanskaya). However, I cannot understand ...