Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [signature]

Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

0
votes
1answer
53 views

Mathematics behind the paper “how to leak a secret” for ring signature

I'm reading the paper "How to Leak a Secret" (Rivest, Shamir, Tauman; 2001). On page 8/14, in chapter 3.4, the authors present the following "combining function": $$C_{k,v}(y_1, y_2,\ldots,y_r) = ...
0
votes
1answer
29 views

The goal, the method, and the interface of the signcrypt primitive.

Some time ago, I proposed making the site more educational by teaching correct cryptographic programming. The proposal had had somewhat good reception, but was met with cold ice as there had been ...
0
votes
1answer
29 views

ECDSA Signing and verifying signatures between Python and JS

I create a signature on js, here jsrsasign Signatures are obtained in the format: ...
1
vote
0answers
38 views

Fiat-Shamir paradigm and the forking lemma

I am reading the proof by Pointcheval and Stern and by Bellare and Neven about the forking lemma. The papers discuss the security proof of digital signatures by applying the lemma. It seems also ...
5
votes
1answer
219 views

RSA PSS security advantage

To my humble opinion, please correct me if I'm wrong, RSA-PSS (PKCS#1 ver 2.1) advantage over RSA as described in PKCS#1 ver. 1.5 is in its security proofs. Does this proof and the advantage is still ...
4
votes
0answers
30 views

Difference between Secure Boot and Attestation [migrated]

What's the exact difference between secure boot and device attestation. Nowadays with secure devices both are used, even at the same time, when in the core they do similar things, which is ...
0
votes
1answer
47 views

Unable to reproduce correct signature data

"Skatteetaten" is the Norwegian tax authority. We're currently trying to implement signing of messages for digital cash registry systems and i'm not able to reproduce the desired signed data. Went ...
1
vote
1answer
73 views

Does the One-Time Hash-based Signature Scheme render Ring Signatures useless?

On the Bitcoin community, to maintain privacy, they recommend using one-time spend addresses. CryptoNote, Monero et al. prefer Ring Signatures to maintain that privacy. There are some issues regarding ...
0
votes
1answer
33 views

ED25519 Child Key Derivation

Let's say I generate a keypair for a user with go's ed25519 package: pub, private := ed25519.GenerateKey(nil) And I want to generate additional child keys as ...
0
votes
0answers
17 views

What is the expected number of messages for which Eve can forge the signature in (repeated) Lamport?

Alice and Bob use the Lamport scheme, but Alice uses the same key to sign two messages (of length $n$). Eve intercepts both these messages. What is the expected number of messages (length $n$) Eve ...
4
votes
1answer
54 views

Hash and sign via trapdoors for lattices

Both the papers GPV'08 and MP'11 present trapdoors for lattices that allow to recover $s\in\mathbb{Z}_q^n$ and the error vector $e\in\mathbb{Z}_q^m$ when given $y=As+e$, for $A\in\mathbb{Z}_q^{m\times ...
0
votes
1answer
44 views

Is the only use for the private key of a root certificate signing certificates issued by it?

A root certificate can be used to issue intermediate certificates. The private key of the root certificate is needed in order to sign any intermediate certificates. However, after that, we only need ...
1
vote
1answer
42 views

What are the different use cases between an HMAC and digital signature? [duplicate]

I understand that both an HMAC and digital signature are used to check the integrity and authenticity of a message. Further, I understand that a digital signature is non-repudiatible. What I do not ...
1
vote
1answer
42 views

Need help understanding public key format of Barreto-Naehrig signature

I have a 256bit signature and a certificate with a public key to verify it. I had little information about the signature scheme used, but I know now that it's "ECBNwithSHA256". I have never come ...
0
votes
0answers
26 views

SOTA updates in combination with a Trusted Platform Module

I am quite new to cryptography and security related stuff. We are working on a new project with Embedded Linux on the BeagleBone Black. We wish to implement a full root of trust during boot up using ...
2
votes
1answer
49 views

Challenge - Response protocol - how to incorporate client randomness

I am designing a challenge-response protocol to enable a client to authenticate to a server. The client has a private key, and a certificate (issued by a trusted CA). At this point in the protocol, ...
6
votes
2answers
224 views

Curve 25519 (X25519, Ed25519) Convert coordinates between Montgomery curve and twisted Edwards curve

I have some misunderstanding about EdDSA conversion coordinates between Montgomery curve and twisted Edwards curve. In https://tools.ietf.org/html/rfc7748 I see that a base point for Curve25519 is ...
1
vote
1answer
54 views

Is a digital signature of use if you don't also encrypt the message containing it?

I'm sure this has been asked before. Its just too blindingly obvious. from wikipedia "Digital signatures, in which a message is signed with the sender's private key and can be verified by anyone who ...
2
votes
2answers
92 views

What's wrong with this digital signature scheme?

With regards to user authentication... The server sends Alice a randomly chosen number. Alice signs the number and sends the signature back to the server. The server checks the signature using Alice'...
0
votes
0answers
21 views

ecdsa_secp521r1_sha384 is it a valid curve/hash combination for ecdsa signature?

In TLS, for certificate authentication, I encountered a ECDSA signature, where the signer was using secp521r1 curve and SHA384 algorithm. Generally the hash strength should match the curve strength ...
2
votes
2answers
104 views

Cryptography scheme to prove you really are the author for something

Say I'm a researcher like Satoshi Nakamoto that wants to stay anonymous. I want to publish documents and sign them somehow. A few years, I want to reveal my identity and prove it was me who was ...
3
votes
1answer
58 views

Could we use a more efficient hash for signature generation?

Is it possible to use a more efficient hash - such as one based on GHASH - instead of a cryptographic hash for signature generation? In other words, could a combination of a fast hash and the private ...
0
votes
2answers
113 views

Digital signature providing a proof of file authenticity

How can a digital signature provide proof the authenticity (not integrity!) of a file?
2
votes
2answers
52 views

Does the Server Key Exchange sign a hash or text

In TLS 1.2 when using ECDHE_RSA, the ServerKeyExchange message contains a signature over the server's ECDHE public parameters. My question is: Is the signature over ...
2
votes
1answer
46 views

Commitment in two party protocols

I have been reading Fast Secure Two-Party ECDSA Signing by Lindell, and I see that in key generating and signing (pages 9-10, especially visible from Figure 1), only the first party performs a ...
4
votes
1answer
86 views

Need help with NFC Tags and cryptography

I have some NFC-Tags, which will be added to my devices. These NFC Tags are basically EEPROMs with an unique UUID (7-Byte, readonly, public) and some constant parameters (approx. 7-15 Bytes, read and ...
1
vote
1answer
40 views

Why would my certificate's signature algorithm differ from its keys' signature algorithms?

I have a signing certificate that I'm loading into an X509Certificate2 object in Visual Studio. I can't get my head around why the certificate itself has one ...
1
vote
2answers
71 views

How to judge a determinant equals non-zero in cryptography?

In the paper [1,p5], the authors construct a matrix to find out $n$ solutions of a equation set as follows: where $c_i$ is generated by the adversary, $c$ is picked by the simulator. Note that $c^i$ ...
1
vote
0answers
26 views

Linkable ECDSA like signature

In our process of digital checks for banking - which needs to work online and offline - the receiver needs to know the chain of all generated signatures without consulting an Internet service. In this ...
2
votes
1answer
51 views

Are the following asymmetric encryption schemes equivalent?

Consider the scenario where you want a machine to be able to send daily encrypted backups to a storage server. You'd prefer to not use simply a symmetric key for encryption, because if the machine ...
1
vote
0answers
94 views

Textbook RSA Signature attacks (without message padding)

I have been reading as much as possible, but I haven't so far found anything exactly like what I'm looking for. I have a couple of questions (given what I know below): One, is it possible to find d? ...
1
vote
2answers
77 views

Can a digital signature scheme also be an encryption scheme?

Using Schnorr signatures, one could devise a system where a single public key can represent multiple signers. Do signature schemes like that represent crypto systems usable for encryption? In that ...
1
vote
2answers
72 views

Encrypting current time using 3DES as a signature

I came across a peculiar system for generating "signatures" ("signatures" is within quotes because this is a bad use of 3DES) in the wild. It works as follows: a symmetric key is generated and used ...
0
votes
0answers
26 views

Adding new participants to a multiparty signature scheme

I'm looking for a signature scheme that allows a group of N parties, without the help of a trusted dealer, to: Jointly create a group public key $P$ Produce a valid signatures for an arbitrary ...
2
votes
1answer
52 views

is the functional signature result relies on f(x) or on x where x is a message and f is a function?

I am new on cryptography and I have a question about the functional signature scheme. The notion was introduced in this paper. In a functional signature scheme, there is a standard signature and ...
1
vote
2answers
132 views

Point of Diffie-Hellman key exchange when public keys are known [duplicate]

Since the basic version of Diffie-Hellman key exchange protocol is vulnerable to Man In The Middle Attack, some sort of authentication is needed. It was mentioned that RSA digital signature can be ...
2
votes
1answer
66 views

What is the relationship between a NIZK protocol and a digital signature scheme?

I am reading about the Fiat-Shamir heuristic to take a $\Sigma$-protocol into a non-interactive zero-knowledge proof (NIZK). I am now wondering whether there is a relationship between a NIZK proof and ...
1
vote
1answer
40 views

MAC and signatures

A message accompanied with a digital signature and a MAC. are there any possibility to know that the digital signature and the MAC are generated from the same message?
2
votes
0answers
41 views

Creating ECC Signature - Is “R” necessary in calculating “S”

After going through the mathematical proof in confirming ECDSA, it doesn't seem apparent to me that "R" is necessary in calculating "S" for the signature. In other words, what's the problem with ...
-1
votes
1answer
246 views

Signing with RSA-SHA256 algorithm using EC keys

Is it practical to sign a data using RSA-SHA256 algorithm with EC keys? I used a small NodeJS script and crypto module (uses openSSL internally) to test this and I could successfully sign the data ...
0
votes
1answer
186 views

ECDSA signing and verification between Python and JS [closed]

I'm trying to have Python (2.7) and JS solutions for ECDSA signing (with secp256k1 curve) where ideally signatures generated by one side can be verified by the other. For the python side, I'm using ...
1
vote
1answer
100 views

Implementing a zero-knowledge proof [duplicate]

I'm trying to get my head around zero-knowledge proofs and my definition of a zero-knowledge proof is as follows. A zero-knowledge proof is a method by which one party can prove to another party ...
1
vote
0answers
17 views

Can the precompiles in Ethereum Byzantium for pairings be used for implementation of BBS group signature verification?

I'm currently implementing a group signature verification on Ethereum and it seems that the Pairing check can only return a boolean. According to the BBS algorithm, to validate a signature $s$, you ...
1
vote
1answer
69 views

What signature aggregation schemes support valid single signature is exist in aggregation signature?

For example, there are three signers, A, B, C: A: PK(a) SK(a) MessageA SignatureA B: PK(b) SK(b) MessageB SignatureB C: PK(c) SK(c) MessageC SignatureC and ...
1
vote
0answers
53 views

ECIES Authentication

In the ECIES scheme, the sender generates an ephemeral public key per each message it encrypts. This public key, together with the receiver's private key, is used in order to generate a shared secret ...
4
votes
2answers
119 views

Atomic multi-party commitments

Alice and Bob publicly choose the messages $M_A$ and $M_B$ and independently sign them (Alice privately signs $M_A$, Bob signs $M_B$). Now Alice and Bob are looking for a protocol that allows them to:...
3
votes
0answers
140 views

Security analysis for a extended ElGamal Signature against selective unforgeability

Let $H$ is a cryptography hash function and $\Pi=(\mathsf{G}, \mathsf{S}, \mathsf{V})$ is a digital signature, as follows: $(h_1=g^x,h_2=g^y) \leftarrow \mathsf{G}(1^n)$, where $x,y$ uniformly ...
1
vote
1answer
105 views

What cryptography primitives can help me (generate unforgeable tag)?

I have a read-only public bulletin board that It contains a series of information to form: $$[(a_1,g^{a'_1 \cdot m}), (a_2,g^{a'_2 \cdot m}), \cdots ,(a_n,g^{a'_n \cdot m})] \ ,$$ where $a_i\in\{0,1\}^...
1
vote
0answers
116 views

Signed XML SignatureValue element value (hash in base64) contains &#xd

My application is .NET based. I have signed xml from third-party environment (Java based). Its signature value base64 string contains carriage return #xd;. ...
1
vote
1answer
52 views

What scalars produce the wrong values with X25519's montgomery ladder?

This question is a consequence of an older one about multiplying a twisted Etwards point in Montgomery space. Turns out that this is unsafe in some circumstances. The following Montgomery ladder as ...