Skip to main content

Questions tagged [signature]

Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

Filter by
Sorted by
Tagged with
1 vote
1 answer
62 views

Definition of "verification"?

I am trying to better understand the concept of verification in cryptography. Verification algorithms are commonly used in message authentication codes (MACs) and digital signatures to confirm the ...
Titanlord's user avatar
  • 2,327
2 votes
1 answer
117 views

Is it possible to use abstract groups to generalize DSA, ECDSA and EdDSA signature creation and verification?

It is known, that DSA algorithm is defined as: Bob Creates private $x$ and public $Y=G^x\bmod p$ keys, where $G$ - generator, $p$ - group prime order Selects random value $k$ from $1 \le k\le q-1$ $...
Azii's user avatar
  • 77
0 votes
1 answer
56 views

What techniques other than zero-knowledge proofs can prove consistency in one-to-many scenarios?

Assuming that there is a sender and multiple receivers, the sender will send the signature $\sigma$ of a certain message $m$ to all receivers, and the signatures $\sigma$ received by these receivers ...
Anja's user avatar
  • 11
2 votes
1 answer
57 views

What Digital Signature Methods are Suitable for Microcontrollers?

Given the constraints in terms of processing power, memory, and energy, what digital signature schemes are commonly used and efficient for Microcontrollers? I have come across RSA with low public ...
Nawras Hussein's user avatar
2 votes
1 answer
207 views

Correct my understanding of Digital Signature Algorithm for TLS certificates?

I just read the Wikipedia page on the Digital Signature Algorithm here: https://en.wikipedia.org/wiki/Digital_Signature_Algorithm Is the signing algorithm explained on the page the one that is used by ...
learningtech's user avatar
1 vote
1 answer
54 views

Question of section 1.3 Intuition for Aborting in "Fiat-Shamir With Aborts: Applications to Lattice and Factoring-Based Signatures"

When I'm reading this paper "Fiat-Shamir With Aborts: Applications to Lattice and Factoring-Based Signatures" by Lyubashevsky. I have trouble understanding section 1.3 Intuition for Aborting....
Solaris's user avatar
  • 15
3 votes
1 answer
143 views

Forgeable and unconfidential short-term signature

I have a very unusual set of requirements for a cryptographic system and hope someone can help me. My requirements are: Asymmetric: A private key is needed to sign, and a public key is used for ...
pils_user_'s user avatar
5 votes
1 answer
207 views

Making signature immune to Colliding Signatures and other threats

Some signature schemes1 have strong Existential UnForgeability under Chosen Message Attack (sEUF-CMA), but still allow Colliding Signatures or/and fail to provide Conservative or/and Destructive ...
fgrieu's user avatar
  • 142k
0 votes
0 answers
38 views

Can ring signatures be considered as non interactive set membership proofs?

Can ring signatures be considered as non interactive set membership proofs? For example, if the message msg is set to null, can the ring signature scheme proposed by Rivest et al. be regarded as a non ...
user109993's user avatar
1 vote
0 answers
64 views

Does unlimited signing oracle leak the private key?

I am writing a PC software that uses a type of USB dongle as licensing key. The dongle functions as a signing oracle and does nothing more: Given any message $M$, it first pads $M$ to $PadM$, then ...
zwhconst's user avatar
  • 111
0 votes
0 answers
30 views

Shared taxonomy for hash, mac and digital signature algorithms and output?

I'm creating a cryptography API, and because naming things is hard, I'm trying to define a common name that identifies functions that accept input of arbitrary length and produce either digital ...
Les Hazlewood's user avatar
0 votes
0 answers
51 views

Multi-signature scheme with support for aggregating signatures of multiple data

If a piece of data belongs to more than one person, we can use a multisignature to sign the data and generate a signature. There are two pieces of data, $\mathrm{data}_1$ and $\mathrm{data}_2$, and ...
chrysanthemum's user avatar
3 votes
1 answer
80 views

Multivariate Cryptography: What is the secret oil space in the MAYO signature scheme?

IN UOV schemes, I understand that you need to choose a secret subspace $O \in \mathcal{F}^q_n$ such that $P(\mathbf{o}) = 0$ for all $\mathbf{o} \in O$. According to the paper Improved cryptanalysis ...
BlockchainThomas's user avatar
0 votes
1 answer
68 views

SPHINCS+ signature calculation and FORS public key

I was trying to understand the SPHINCS+ document from https://sphincs.org/data/sphincs+-r3.1-specification.pdf and have the below doubts. Consider the example of SPHINCS+-128s , the value of n,h,d,log(...
Gappu's user avatar
  • 31
0 votes
0 answers
75 views

Simple and efficient auth scheme to prevent replay attacks

This is a machine-to-machine authentication proposal with the following requirements: Avoid replay attacks. Leaked or intercepted auth tokens cannot be reused at all. Impersonation resistant. The ...
actonchart's user avatar
2 votes
2 answers
146 views

Short software license keys with asymmetric verification

Would it be possible to implement a modern version of the old software license key scheme that uses an asymmetric signing approach, while keeping the length of the key short, say 40 chars of base64? ...
Larsp's user avatar
  • 23
1 vote
1 answer
86 views

ADRS in WOTS+ signature scheme

I am trying to understand the sphincs+ from [1] and have a fair understanding of WOTS+ scheme from [2] However, in the OTS scheme defined in [1] , it seem to use ADRS for storing chain address, hash ...
Gappu's user avatar
  • 31
1 vote
0 answers
50 views

Can the ability to sign arbitrary messages expose the private key?

Consider a system that consists of a black box (some abstraction layer with perfect sandboxing). The black box contains a private key that cannot be extracted by request, but the black box exposes an ...
The Quantum Physicist's user avatar
0 votes
2 answers
59 views

Not able to find any references for opening of BBS+ signature

I've reviewed the BBS signature scheme and the constant size k-TAA, known as BBS+. However, I couldn't find any specific mechanism for opening in BBS+. In the constant size k-TAA, if a user attempts ...
Reisha Ali's user avatar
0 votes
1 answer
35 views

Digest Signing for GPG Packages

We're currently using file type-specific signing tools (textsign, helmsign, rpmsign) for GPG packages, creating network strain by transmitting entire packages to a signing server. To optimize this, we'...
undefined's user avatar
  • 103
1 vote
0 answers
44 views

Unable to find any references for opening of BBS+ signature [duplicate]

I've reviewed the BBS signature scheme and the constant size k-TAA, known as BBS+. However, I couldn't find any specific mechanism for opening in BBS+. In the constant size k-TAA, if a user attempts ...
Reisha Ali's user avatar
1 vote
0 answers
98 views

Math of Hint usage in Dilithium

For Dilithium, I understand that $$\text{HighBits}(\mathbf{Ay}) = \text{HighBits}(\mathbf{Ay} - c\mathbf{s_2}) = \text{HighBits}(A_z - c\mathbf{t})$$ The first term of the equation is performed on the ...
Gappu's user avatar
  • 31
1 vote
1 answer
58 views

The comparison of public keys corresponding to signatures based on secp256k1

Can two signatures based on the elliptic curve secp256k1 be compared to determine if they use the same public key without recovering the public keys?
deowne chen's user avatar
1 vote
1 answer
79 views

Why $1\leq r\leq p-1$ verification is needed for (hashed) Elgamal signature?

I am reading the "Handbook of Applied Cryptography" by Menezes et al. (hashed) ElGamal Signature verification in this book talks about verification of $1\leq r\leq p-1$. Subsequently, this ...
mxant's user avatar
  • 31
0 votes
2 answers
100 views

Is it possible to verify that two different signatures of the same message came from the same private key?

Knowing that ECDSA signatures are non-deterministic (barring RFC 6979), is it possible to verify that two different, yet valid signatures of the same message came from the same private key? To provide ...
jtanza's user avatar
  • 3
0 votes
0 answers
22 views

[MS-WCCE]: Windows Client Certificate Enrollment Protocol - Null Signature

MS ADCS is using Windows Client Certificate Enrollment Protocol for issuing and renewing certificates. In the [MS-WCCE]: Windows Client Certificate Enrollment Protocol document, there is a chapter 2.2....
user1563721's user avatar
0 votes
2 answers
73 views

New Service to Service Protocol Presented for Public Scrutiny (Time-based Token Signing), Is it Safe?

I came up with the following protocol to provide a life-time for JWT tokens while differentiating services to communicate securely with web services (service-to-service) using symmetric key signing ...
Adam Memisyazici's user avatar
0 votes
1 answer
106 views

Should hash salt and public key be a part of cryptographic signature?

I'm updating some piece of software I wrote quite some time ago. It is supposed to sign some content. So at the moment I have the following process: I have a (private, public) keys pair. These can ...
freakish's user avatar
  • 103
1 vote
0 answers
13 views

Is aggregator consider trustworthy in a CLAS scheme

In certificateless aggregate signature (CLAS) scheme, is an aggregator consider trustworthy? Can they act as an adversary, where they can alter the messages from the users and create a new valid ...
Rabindra Moirangthem's user avatar
1 vote
1 answer
58 views

Signing a file vs. a manifest of cryptographic hashes

I’m interested in the tradeoffs of signing individual files vs. signing a manifest of cryptographic hashes and file names. Let’s say I do some work that results in a handful of files (10s to hundreds),...
baseboard49's user avatar
1 vote
0 answers
134 views

Random padding of RSA-signed message at end instead of beginning of the message

I’ve a signature scheme for 1024‒bit RSA with a 65537 exponent. The signed message is constructed as follows: 760‒Bits fully_user_controlled_message_content+8 Bits incremental nonce+sha256(...
user2284570's user avatar
2 votes
0 answers
48 views

Can signature be repurposed?

Given public key $pk$, message $M$ and its signature $\sigma$, is it possible to get another $pk'\not =pk$, $M'$ with the totally same signature $\sigma$? In other word, the following ones are both ...
Twiforest's user avatar
4 votes
1 answer
140 views

Changing ECDSA for Shorter Signatures: deterministic k

I am exploring a modification to ECDSA to produce shorter signatures, even though it compromises security (in a controllable way). My rationale behind this change is in this discussion. In my ...
Ehsan's user avatar
  • 51
0 votes
0 answers
32 views

Why record signing in Rekor when using private key?

Intro When using cosign for keyless signing, the flow that happens is as such: The user runs cosign sign to sign an artifact Cosign redirects the user for a OpenID ...
YoavKlein's user avatar
  • 159
1 vote
0 answers
22 views

Can an aggregator be a type 1 adversary?

In a certificateless aggregate signature scheme, can a signature aggregator be a type 1 adversary (external attacker who can have access to secret value of a user)? I thought signature aggregator is ...
Rabindra Moirangthem's user avatar
0 votes
0 answers
30 views

Signature forgery in different adversarial settings

I'm currently studying the different adversarial settings for digital signatures. In Goldwasser, Micali and Rivests paper they propose three different chosen message attack settings, which are vastly ...
limeeattack's user avatar
0 votes
1 answer
71 views

EdDSA protection of deterministic algorithm against replay attacks

EdDSA generates the private nonce deterministically by hashing the private key and the message, and this means that the public nonce $r$ and the signature s will be same if the same message signed ...
Nawras Hussein's user avatar
1 vote
2 answers
835 views

sign a JWT with RS256 using a RSA-PSS SHA256 key pair?

Given a private key using algorithm RSA-PSS with SHA256 is it possible to use this key to sign a JWT using algorith RS256 (RSA with SHA256) instead of PS256 (RSA-PSS with SHA256)? The German ...
Basti's user avatar
  • 113
1 vote
0 answers
70 views

Encryption + EUF-CMA => SUF-CMA

Does there exist a proof (paper reference welcome) that if a signature scheme is EUF-CMA, and the signatures are always encrypted, then the resulting signature scheme is SUF-CMA? That is: let SIG be ...
Mario's user avatar
  • 31
3 votes
1 answer
97 views

How to reconstruct low order bits of $t$ of CRYSTALS-Dilithium from a small number of signatures?

In FIPS 204 (https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.204.ipd.pdf): "The vector $\textbf{t}$ is compressed in the actual public key by dropping the $d$ least significant bits from each ...
Jong Hyeok Lee's user avatar
2 votes
1 answer
642 views

How could a 1024‒bits RSA modulus be most economically factored within months today?

Of course this is a question with an answer that is due to evolve. A 2002 paper about TWIRL stated that the cost would be around 10M\$ and an other 10M\$ to manufacture the device. A later 2007 paper ...
user2284570's user avatar
0 votes
0 answers
21 views

Aggregate Signatures Overview

I've been learning about aggregate signatures lately, are there any overviews or learning materials about aggregate signatures (including security properties)?
Ping Ping's user avatar
0 votes
0 answers
29 views

P256 signature verification was succeed with 2 public key [duplicate]

I tried to recover public key from P256 signature. With 2 recovery id ( 0, 1 ), signature makes 2 public key. And I tried to verify signature with public key and verification was succeed all of 2 keys....
박해성's user avatar
1 vote
0 answers
67 views

Using Deterministic ECDSA (secp256k1) Signature as a Cipher Key in Symmetric Encryption

I'm exploring the security implications of utilizing a deterministic ECDSA signature as a cipher key for symmetric encryption and would appreciate insights from the community. Here's the setup I'm ...
landabaso's user avatar
  • 111
1 vote
0 answers
93 views

Does 'digitization' of tickets always need private data? Or is it just data gathering? Any simple method without?

Many companies argue their gathering of private data with 'digitization' but I guess their real intention is most likely just gathering data. However I didn't came up with a simple idea without it. ...
UncleBob's user avatar
6 votes
2 answers
361 views

RSA signatures without padding by using XOF output in range [1, n-1]

RSA signatures are implemented by encrypting the padded hash with the private key. Why not take the approach RSA-KEM is using by removing the padding entirely and replacing the hash with a XOF that ...
Jackie Lanhorn's user avatar
1 vote
1 answer
417 views

Differences between two RSA signatures using OpenSSL

I want to sign a file called data.txt and store its signature in data.txt.sig. To create the signature, I want to use an ...
Allgaeuer's user avatar
  • 123
4 votes
1 answer
246 views

Split a private key into shares and sign successively or separately

Assume I have a private key, priv_k, a public key pub_key and a message, msg, along with its ...
Ryan's user avatar
  • 141
0 votes
1 answer
104 views

Looking for a modifiable signature!

I am a graduate student and have encountered some problems in my research. When I generate a signature on the data block of the file, and the signature is composed of the user's private key, the data ...
nan gan's user avatar
1 vote
0 answers
58 views

ring signature with embedded data

As part of Spontaneous Anonymous Group (SAG) signatures of say 16 participants, the prover generates fake random responses for 15 elements and a real response at some secret index. I want to hijack ...
sandeep kiran p's user avatar

1
2 3 4 5
30