Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [signature]

Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

0
votes
1answer
28 views

Where does the certification come from

In the book : applied Cryptography 2nd(Bruce Schneier), chapter 2 I don't understand step(5), the 'certification' didn't mention in previous steps. does it mean 'a statement that he has received this ...
0
votes
0answers
9 views

Using Chameleon-HF-enabled security in practice

If one were to implement a digital signature scheme that is only EUF-CMA-secure when using Chameleon Hash Functions, would one actually use a Chameleon Hash Function or a standard cryptographic hash ...
1
vote
1answer
24 views

Monero Ring CT sj calculation

For a university project, I am currently implementing the RingCT Ring signatures as used in Monero (before the introduction of Bulletproofs) as laid out in this paper. To close the ring we calculate ...
0
votes
1answer
32 views

Is there a lower limit on message length for signature?

I was working on a tool that signs small messages (~20 bytes) when a question occurred about message size: What would be the risk of using extremely small/restricted input (say, 5 bytes of hexadecimal ...
0
votes
0answers
65 views

Digital Signature Password verification

I currently have this TOFU protocol: First connection: Client generates salt and inputs a password Client saves salt Client hashes password with argon2 and salt Client generates Ed25519 keys Client ...
0
votes
0answers
25 views

minisig vs signify [migrated]

I've recently came across the signify tool which is the OpenBSD solution to sign and verify files. Excluding GPG, I only knew about minisig to to achieve the same effect. I'm trying to figure out ...
1
vote
1answer
48 views

NTRUSign (considered broken) as a one or few time PQ signature scheme

As many know, original NTRUSign is considered broken as signatures leak information about the private key. It takes a number of signatures to accomplish a break though, with the original break paper ...
1
vote
0answers
25 views

How to get the key data from the pkcs#8 format? [closed]

Being newbie to crypto, I understood that RSA keys are shared are pairs $(e,n)$ or $(d,n)$. But when I was given a doc with keys, they were in PKCS#8 format. How to get the keys out of this format?
0
votes
0answers
41 views

How can users be authenticated without revealing their identity on a massive scale? [on hold]

I want to create a system where a user can be authenticated without revealing who they are. I assume I have a list of public keys for all users (E.g. government issued). Ring signature could be used ...
1
vote
0answers
21 views

How does the KeyGen of Merkle's improvement of Lamport's OTS work?

In his paper [1] on page 17 and 18, Merkle proposes an improvement on Lamport's OTS by only signing the 1's in the message in combination with a checksum of the amount of 0's in the message. I get the ...
0
votes
1answer
36 views

How to prevent Public Key from being replaced entirely?

I am using RSA to sign my license file using Microsoft CNG API. I am signing the license file and sending the file with the <...
2
votes
1answer
50 views

How does the Signature Scheme in Picnic Works

I am trying to understand how signature scheme proposed to NIST, Picnic, works. The propossal uses ZKboo and ZKboo++ as their basis. I can see how the ZKPoK works, where the witness x is some key ...
1
vote
1answer
50 views

Does the signatures generated by a revoked member before revocation remains valid in VLR group signatures

Group signatures allow any member of the group sign the message on behalf of the group anonymously using his own secret-key. Only group manager can reveal the identity of the signer. Verifier Local ...
1
vote
1answer
46 views

Is it possible to derive related signature?

For example, the message is a json: {name: john, age: 13}, and is sealed with signature. Now, is it possible to derive a signature for the new message: ...
0
votes
0answers
42 views

Problem with e-cash system with multiple banks

Say that many banks issue electronic cash of a particular type. If there is a malicious bank and user collusion, the malicious bank signs electronic cash for a particular user. This user then takes ...
0
votes
1answer
49 views

Security strength EC signature for variable message size

I am implementing a system using some sort of 32bytes OTC (One-Time Code) and signing it with ECDSA to get verification of a public key owner. The key I'm using is ...
0
votes
2answers
67 views

How to understand Authenticated Key Exchange?

I am reading some articles about Key Exchange. I know classic key exchange,such as Diffie-Hellman key Exchange. This type algorithm is vulnerable to man-in-the-middle attack. However, When using ...
3
votes
1answer
43 views

What is the RFC order of peer certificate verification, trust chain or expiry first?

If a certificate received from a peer: Is expired, has a valid signature, but from an untrusted root CA What error should be thrown? Untrusted certificate or expired certificate? I can't seem to ...
1
vote
1answer
36 views

ECDSA over $\mathbb{F}_{p^n}$ for $n>1$. How to calculate $r$ and $s$

I'm having some trouble understanding how to calculate $r$ and $s$ as specified in the wikipedia page for ECDSA (https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm) We can see ...
0
votes
2answers
48 views

cryptographically signed streaming data

On a high level the question is: how does one cryptographically sign streaming data? Here is the context: a number of people are continuously streaming data to me the data is public and does not ...
1
vote
0answers
62 views

Overcome MD5-RSA Signature verification

I asked this question already at the Information Security SO site, but my research on how to overcome this problem ended always on the crypto site. That's why I will try to find some help here :) I ...
0
votes
0answers
50 views

Choosing K in ECDSA SECP256K1

I am working on a very resource-constrained environment. Using a standard peer reviewed library isn't possible because it won't fit within the RAM requirements of the device (~5K unused ram without ...
1
vote
1answer
69 views

DSA: why using mod p mod q and not just mod p

I'd like to know, in DSA we compute several values modulo $p$ and modulo $q$, like $r = (g^k \bmod p) \bmod q$ or $v = (g^{u_1}h^{u_2} \bmod p) \bmod q$. As far as I understand, we want to use two ...
2
votes
1answer
125 views

Why is encryption slower than decryption in elliptic curve cryptography (ECC)?

While performing encryption using public key and decryption using the private key, I am always finding that encryption takes more time than decryption in elliptic curve cryptography (ECC). It's the ...
0
votes
0answers
50 views

RSA Signature Forgery - Low Public Exponent + Improper Padding Validation? [duplicate]

Consider the following custom crypto: We have a signed message M1 with corresponding signature S. We have the 1024-bit modulus <...
0
votes
0answers
35 views

Are there any multi-signature scheme used in IoT?

I have searched on Google the keywords "multi-signature, IOT", but it seems that not many papers related to that have been proposed. What I found most is related to blockchains. My motivation is, in ...
0
votes
2answers
107 views

What is the difference between RSASSA-PSS signing and RSA-PSS signing?

I read the RFC 8017 and understood the pkcsv1.5 and pss padding techniques. I understood that in RSASSA-PSS signing scheme the signature will be appended at the end of M. In some websites I read both ...
-1
votes
1answer
92 views

What are the inverse operations in elliptic curve cryptography?

Public-private key cryptography is based on inverse operations that use separate input. In elliptic curve cryptography, what are those inverse operations?
2
votes
2answers
76 views

Is it possible to use X.509 for a symmetric-key algorithm?

I read on wikipedia what is X.509: In cryptography, X.509 is a standard defining the format of public key certificates. X.509 certificates are used in many Internet protocols, including TLS/SSL, ...
4
votes
0answers
50 views

Why is it safe to generate the secret key and masking vectors using rejection sampling in CRYSTALS-Dilithium?

In CRYSTALS-Dilithium module lattice-based digital signatures, the secret key vectors $s_1, s_2$ with coefficients in $[-\eta, \eta]$ and the signature masking vector $y$ with coefficients in $(-\...
6
votes
2answers
172 views

Understanding forking lemma and oracle replay attack

Many signature schemes use forking lemma to prove security, like scheme in here.In short, that goes through a reduction technique which called oracle-replay attack to solve the difficult algorithmic ...
2
votes
0answers
19 views

How many signatures can a signing key (safely) produce

Given an AES key, there is a limit (of about $2^{64}$ blocks) of how much plaintext it is safe to encrypt with the key. Is there a similar limit for how many signatures it is safe to produce with a ...
1
vote
1answer
38 views

Private key not used in a signature scheme

I'm trying to understand the following signature scheme (Camenisch-Lysanskaya): Key generation: $n = pq$ special RSA modulus, $a, b, c \in QR_n$. $PK = (n, a, b, c), SK = p$. Signing algorithm: $m$ ...
3
votes
1answer
77 views

Comparison of security definitions for signatures

The two main security definitions for signatures are EUF-CMA and the strong version of it sEUF-CMA. What I see that their difference is that in EUF-CMA experiment, the adversary needs to produce a ...
4
votes
1answer
101 views

Are commutative digital signature possible?

Say we have a message $m$. Signer $S^1$ will sign this message using his digital signature to produce: $$\operatorname{Sign}_{S^1}(m)$$ Now, say another signer $S^2$ wants to sign the output of the ...
0
votes
0answers
40 views

Prove that a given signature scheme is secure under random message attacks

This is a follow up to my previous question. Consider the following signature scheme: $\operatorname{KeyGen} (1^k$) : On input of a security parameter $k$, choose a symmetric bilinear group with $...
0
votes
0answers
34 views

Prove that a signature scheme is RUF-NMA and not EUF-CMA

I am working on the following exercise: Now, assume the following signature scheme: $\operatorname{KeyGen} (1^k$) : On input of a security parameter $k$, choose a symmetric bilinear group with ...
3
votes
1answer
317 views

Is there a symmetric-key algorithm which we can use for creating a signature?

I know that in the asymmetric-key algorithm the RSA signature exists but what about the symmetrical ones?
4
votes
2answers
174 views

Would a HMAC digest make sense in an RSA / ECDSA signature?

When MD5 and SHA1 were broken there was, each time, a scramble to upgrade software and certificates to remove the offending algorithm. However, in each case, the HMAC variant of each hash function was ...
0
votes
2answers
89 views

Why doesn't the formula work when checking two ECDSA signatures?

There are two generated ECDSA signatures X - Private key S = ((Z + (X * R)) / K) mod n S` = ((Z` + (X * R`)) / K`) mod n G - Base point, of order n; ...
3
votes
2answers
137 views

Which hash is used when providing signature algorithm ED25519 or ED448?

From TLS 1.3 there are two signature algorithms using edDSA: /* EdDSA algorithms */ ed25519(0x0807), ed448(0x0808), All the other signature-...
1
vote
1answer
31 views

Where can I find the standard definition for GPG ECDSA signature?

I am playing around with GPG which I'd like to use to sign an integer and use the resulting signature binary in another piece of code. So far I have created a simple PGP packet parser with which I ...
1
vote
3answers
113 views

Digital Signature Algorithm for large files - bottle-necked by hash function?

I am new to studying digital signatures like ECDSA and EdDSA, and was curious about something. Lets say hypothetically I want to create a digital signatures of millions of files, with a total size of ...
0
votes
1answer
54 views

PKCS#10 why keeping the Subject Public Key in the X.509 Certificate

In the pkcs#10 workflow to obtain the x.509 certificate used in digital signature, in the Certificate Request Information, itself in the CSR, we have the Subject Public Key. That Subject Public Key ...
2
votes
1answer
76 views

Generating a key pair using a signature generated by an existing key

I’ve built an app in which each user has a private/public key pair and I want to generate a second one for them, however I cannot store the second private key anywhere. What would be the drawbacks ...
2
votes
1answer
80 views

Generating a small EDDSA curve

I have an application that would benefit from very small (e.g. 16-20 byte) EDDSA keys and small signatures. It's an application where the goal is more to deter DOS attacks than "hard" security, so ...
0
votes
1answer
45 views

Using the same RSA key for verifying a website and digital signature

We have the (same) RSA key for verifying a website and for digital signature. A user would send a nonce encrypted using the public key, the websites returns the nonce by decrypting it using the ...
2
votes
1answer
170 views

How to identify RSASSA-PSS from rsaEncryption OID?

Following the RFC 8446 it states that: RSASSA-PSS RSAE algorithms: Indicates a signature algorithm using RSASSA-PSS [RFC8017] with mask generation function 1. The digest used in ...
4
votes
2answers
507 views

How can I hash an input into an arbitrary domain point?

I am trying to implement a signature scheme involving RSA signing of a message digest generated by SHA-$256$. I want to hash the input into an RSA domain point instead of the fixed $256$ bit digest ...
6
votes
1answer
106 views

Is it important to defend against key substitution attack in ECDSA?

When planning a file signature scheme (basically, just to sign all files content). Is it obligatory to defend against ECDSA key substitution attack? ISO/IEC 14888-3:2018 NOTE 5 states: The ...