The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [signature]

Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

Filter by
Sorted by
Tagged with
0
votes
0answers
21 views

Possible to convert PGP ed25519 signature into signify-compatible format?

Both PGP and Signify (or Minisign) are capable of generating ED25519 detached signatures. Is it possible to convert a PGP-generated ED25519 signature into a signify-compatible format?
3
votes
0answers
45 views

Using (EC)DH to generate a signature

Say I have access to a system that is limited to performing (EC)DH, followed by key derivation to produce a secret key. This secret key can e.g. be used to generate a MAC. Is it possible to generate a ...
0
votes
0answers
23 views

How to validate the randomness of ECDSA signature generated using HSM? [migrated]

I need to programmatically(using Python) validate whether the signature generated by using HSM RnG is actually random. Didn't found much content online, hence any help would be appreciated !!
1
vote
0answers
18 views

Post-quantum aggregate / multi signatures

Are there any practical post-quantum aggregate / multi signatures? Currently, the aggregate / multi signature schemes seem to be limited to pre-quantum elliptic curve assumptions only, e.g., [BDN18], [...
3
votes
1answer
62 views

Using ePassport with Active/Chip Authentication to sign documents

I'm a complete newby, so please pardon my ignorance when it comes to basic cryptography aspects. My question is whether a biometric passport with Active/Chip Authentication (AA or CA) can be used to ...
0
votes
0answers
23 views

How to validate the authenticity and integrity of an XML document?

I am working on a C++ desktop application that reads an XML (also created by my org) from a public server (does not require authentication). I would like to make sure that the downloaded XML has not ...
0
votes
1answer
59 views

False positives in a signature scheme [on hold]

Let's considerer a bloom filter: there, we can include witness of membership; false negative isn't possible, but it can exist some significant probability of false-positives. But, what if we demand ...
0
votes
1answer
42 views

Can I use a government-issued certificate in Outlook? [closed]

My government issues certificates for many purposed, including e-mail signing. The government doesn't provide e-mail addresses, but it does declare my e-mail in the certificate. Can I use this ...
1
vote
1answer
25 views

Group Signatures with VLR Revocation Check

I was reading the paper by Boneh et al. Link. The scheme describes what is called a Verifier Local Revocation Technique. The Scheme assumes that a Revocation List [RL] allows each verifier to check ...
1
vote
1answer
49 views

Can we use BLS as a VRF?

Intuitively, it seems that the hash of a BLS signature could be used as a VRF as well. In a nutshell, BLS-Signature is the VRF output and the verification first ...
0
votes
0answers
5 views

Sign Verify problem by provider in JCA [migrated]

I'm trying to sign and verify my data with SHA256withRSA,MD2withRSA,SHA1withRSA,SHA512withRSA modes. My provider supports all of them but, just MD2 mode works for my code. Other ones does not work, ...
2
votes
0answers
38 views

What are some use cases for white-box digital signatures?

There were 2 papers published in the last year, that describe 2 different white-box identity-based digital signature schemes: White-Box Implementation of the Identity-Based Signature Scheme in the ...
0
votes
1answer
36 views

Signing data packets increases data size too large for packet to contain

In a setup where the client signs then encrypts outgoing data packets to a VPN server / onion network, an ECDSA signature appended to the plaintext before encryption could cause the data to be too ...
0
votes
1answer
45 views

How to check runtime of e.g. Ed25519 signature algorithm

As mentioned here the verification of a Ed25519 signature takes roughly 3 times as the time for the generation of a signature. Two questions on that: 1) Can I assume that this is a rule of thumb for ...
0
votes
0answers
8 views

Openssl DSA Signature Verification Failure Error not understood [migrated]

I am given a public key in PEM format: ...
0
votes
0answers
80 views

Encoding function for ISO 9796-2

I try to reproduce the analysis conducted in this presentation by R. Lifchitz. Namely, data signed by an 1024-bit key $n$ (Rabin scheme) and following ISO/IEC 9796-2. From what I understand, for a ...
1
vote
0answers
23 views

Does a digital signature algorithm exist which has a normal, a blind, an elliptic curve and an elliptic curve blind version?

Q: Does a digital signature algorithm exist which has a normal, a blind, an elliptic curve and an elliptic curve blind version? I am searching for an algorithm where you can see what happens if you ...
0
votes
0answers
12 views

Is it possible to sign a message with a base58 secret key with Tweetnacl library? [migrated]

I've generated a key pair using Tweetnacl.js: ...
1
vote
1answer
72 views

How android apk file signing works?

There are a number of pages on web to tell how to sign apk file for Android. But none I've found telling how it works under-the-...
2
votes
1answer
106 views

Proof of application of $f(x)$ without disclosing input $x$

I have three nodes in a network: $\mathcal{S}$,$\mathcal{T}$,$\mathcal{R}$. $\mathcal{S}$ supplies data $x$ to $\mathcal{T}$. $x$ is signed so $\mathcal{T}$ knows it actually comes from $\mathcal{S}$...
2
votes
1answer
95 views

What is Reverse Trapdoor Function?

In wikipedia on Digital_signature: but rather, the message to be signed is first hashed to produce a short digest, that is then padded to larger width comparable to N, then signed with the ...
0
votes
0answers
26 views

Relationship between special RSA modulus and quadratic residue in CL (Camenisch-Lysyanskaya) signature

I'm studying the CL(Camenisch-Lysyanskaya) signature (A signature scheme with efficient protocol proposed by Camenisch-Lysyanskaya). However, I cannot understand ...
1
vote
2answers
64 views

How does ECDSA signature verify work in EOS and ETH/BTC, compare to standard (on text book I mean)

I have been studing ECDSA signature/verify for a while. By my understanding: the standard ECDSA signature/verify process (which we find on text book) are like below: - A sender combines message and ...
1
vote
1answer
50 views

RSA-FDH Signature Scheme EUF-CMA

I am aware of attacks whereby an attacker is able to forge a message IF the hash of the original message is the same hash as their current message. The question is, is it still possible for RSA-FDH to ...
3
votes
2answers
109 views

Attack on security model for RSA-FDH

I recently read in Cryptography textbooks and online videos that compared to Textbook RSA which is insecure against Chosen Plaintext Attacks (CPA) and Chosen Ciphertext Attacks (CCA), RSA-FDH is ...
0
votes
1answer
91 views

How to decide whether to use digital signature (RSA) or HMAC

I found multiple posts regarding the differences between HMAC and RSA. Why should I prefer one or the other? These are some examples: HMAC SHA256 vs RSA SHA256 - which one to use What are the ...
1
vote
1answer
76 views

Risks of publishing multiple signatures

Is there a risk when publishing multiple signatures for the same message? For instance, an ECDSA key (using an EC key) and a RSA-PSS signature (using a RSA key). The context of my question is the use ...
-1
votes
1answer
72 views

Can't understand the magic of relationship between private an public key functions

To encrypt a message $$ P = 53, Q=59, n=PQ=3127, e =3 $$ let message M, for example, $ 89 $$ cipher = 89^{e}mod\quad n. $$ cipher = 1394 this is the encrypted message $$ \phi=(P-1)(Q-1)=3016 $$ $$...
1
vote
1answer
26 views

Signing a binary hash vs character representation of the same hash

I have a hash that I want to sign, with the hexadecimal representation: hash_bin=0x11223344 (length 4 bytes). The same hash also has a character representation hash_text=”11223344”, which is the ...
0
votes
1answer
43 views

Validating JWT works with small changes to public key, why?

I was trying to verify the following JWT on JWT.io with the following public key: ...
2
votes
1answer
49 views

Understanding need for PKI

For simplicity let's say I only have RSA and AES on my hands and I want Alice to talk with Bob over a secure channel. With secure I am implying no MITM and Alice and Bob know they are talking to each ...
0
votes
0answers
33 views

Is there an O(1) in space complexity k-of-n signature scheme?

I was looking in depth into Schnorr signatures recently, and while they are very attractive for their ability to be aggregated, this only works for n-of-n ...
1
vote
0answers
64 views

How to sign comitted group elements?

I'm actually searching some particular primitive compatible with Groth Sahai commitment. I would like to know a signature scheme (on group elements), such that there exists an algorithm $\mathtt{...
4
votes
2answers
132 views

What is cryptographic sealing?

While revising my CAdES library I encountered some "sealing issue" in digital signatures. The Win SDK signtool.exe has a /seal ...
1
vote
1answer
77 views

Signal protocol, how is Signed PreKey created?

I am getting confused with what exactly is the nature of the Signed Prekey (SPK) used in signal protocol. I understand what it is used for, but I think the confusion stems from its name. Is it just ...
1
vote
0answers
29 views

Why, in general, are proofs of possession (POPs) “clearly” not sufficient for substantiating the knowledge of secret key (KOSK) assumption?

In Ristenpart, Yilek - The Power of Proofs-of-Possession: Securing Multiparty Signatures against Rogue-Key Attacks they have the statement: In general, such proofs of possession (POPs) are clearly ...
1
vote
1answer
37 views

Are there any signature algorithms with pseudorandom signatures?

As the title says. My reference point for the "pseudorandom ciphertext" concept is this paper by Möller, which introduces a public-key encryption algorithm with this property. I want to know the ...
5
votes
1answer
285 views

Difference between Pure EdDSA (ed25519) and HashEdDSA (ed25519ph)

My question refers to EdDSA as specified in RFC 8032. I get from the RFC that ed25519 and ed25519ph are two different instances of EdDSA mainly differing in the fact that that in the case of ...
4
votes
2answers
120 views

Isn't code signing just digital signature on code?

I have been trying to understand why code signing is treated or discussed differently from digital signature. Digital signature is signing a hashed BLOB with a private key. When the BLOB is code/...
1
vote
0answers
83 views

Efficient protocols for set membership proofs with private sets

I found the paper on Efficient Protocols for Set Membership and Range Proofs in which efficient protocols for the following problem are discussed: Given a commitment $C_v$ to a value $v$ we want show ...
0
votes
0answers
63 views

If I have two ECDSA signatures that use the same k (nonce) but different secret keys, can the secret key be computed? [duplicate]

I have two ECDSA signatures $(r, s_1, z_1)$ and $(r, s_2, z_2)$ where $s_1 = (z_1 + r*x_1) / k$, and $s_2 = (z_2 + r*x_2) / k$. Can $x_1$ & $x_2$ be computed?
0
votes
1answer
13 views

How to let CA signed x509 key work in OpenPGP mailing system?

So let's say we have a OpenPGP mailing system which all mails are signed and encrypted with OpenPGP keys. And now you bought a CA signed x509 certificate and you want to imement into the mailing ...
0
votes
0answers
51 views

Long-term signatures

I’m looking for suggestions on how best to handle signatures on audit records that might need to be held for many years (at least 5, maybe up to 10). Not in terms of storage - they’ll probably be ...
13
votes
2answers
667 views

Is it safe to reuse a ECDSA nonce for two signatures if the public keys are different?

We denote the s value of an ECDSA signature $(r, s)$ on a message $m$ as: $s=\frac{H(m)+xr}{k}$ Assume two ECDSA signatures sharing the same nonce $(r, s_1) , (r, s_2)$ on two messages $m_1, m_2$, ...
0
votes
1answer
35 views

Difference between XMSS and MSS-SPR

I am currently studying stateful hash based signatures. In the XMSS paper the authors claim that XMSS signatures are 4 times smaller than those of MSS-SPR. However I do not get how it is possible, ...
1
vote
0answers
32 views

Include TSA Certificate in Timestamp Request

Im currently working on Timestamping and stumbled upon a parameter fRequestCerts/requestSignerCertificates/certReq that according to the documentations tells a TSA to include the certificate that was ...
1
vote
0answers
42 views

ElGamal: different message with equal length random key [closed]

This situation applies to ElGamal digital signatures: consider messages m1 and m2 which we will encipher with a random key. The random key has the same Hamming weight. Is this situation secure? Why? ...
2
votes
0answers
21 views

What signature schemes allow for a space efficient multisig? Any that also allow others to easily add to an existing signature?

For instance, Is there a scheme where 100 people could produce a signature that is only as long as one signature? Is there one like this that can be done where each person can merely modify an ...
0
votes
1answer
68 views

Signature verification vs decryption?

I've found this explanation regarding signature verification but I still confused In the example in the picture, the sender sign the hash using his secret key. The output of signing produces a ...
0
votes
0answers
32 views

Method for getting encryption keys from U2F key

There are a number of questions on this site about how/can you use a U2F key to encrypt something. The main problems with doing this are that U2F keys were designed for authentication, so all they can ...