Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

2
votes
2answers
24 views

Does the Server Key Exchange sign a hash or text

In TLS 1.2 when using ECDHE_RSA, the ServerKeyExchange message contains a signature over the server's ECDHE public parameters. My question is: Is the signature over ...
2
votes
1answer
41 views

Commitment in two party protocols

I have been reading Fast Secure Two-Party ECDSA Signing by Lindell, and I see that in key generating and signing (pages 9-10, especially visible from Figure 1), only the first party performs a ...
4
votes
1answer
75 views

Need help with NFC Tags and cryptography

I have some NFC-Tags, which will be added to my devices. These NFC Tags are basically EEPROMs with an unique UUID (7-Byte, readonly, public) and some constant parameters (approx. 7-15 Bytes, read and ...
1
vote
1answer
32 views

Why would my certificate's signature algorithm differ from its keys' signature algorithms?

I have a signing certificate that I'm loading into an X509Certificate2 object in Visual Studio. I can't get my head around why the certificate itself has one ...
0
votes
0answers
46 views

Can't sign with DSA [migrated]

A DSA key is created with: ...
0
votes
0answers
15 views

Why is Bob's identity key needed in X3DH?

From X3DH specification, when Alice sends Bob a message DH1 = DH(IKA, SPKB) DH2 = DH(EKA, IKB) DH3 = DH(EKA, SPKB) SK = KDF(DH1 || DH2 || DH3) Why is DH2 ...
1
vote
2answers
70 views

How to judge a determinant equals non-zero in cryptography?

In the paper [1,p5], the authors construct a matrix to find out $n$ solutions of a equation set as follows: where $c_i$ is generated by the adversary, $c$ is picked by the simulator. Note that $c^i$ ...
1
vote
0answers
24 views

Linkable ECDSA like signature

In our process of digital checks for banking - which needs to work online and offline - the receiver needs to know the chain of all generated signatures without consulting an Internet service. In this ...
2
votes
1answer
48 views

Are the following asymmetric encryption schemes equivalent?

Consider the scenario where you want a machine to be able to send daily encrypted backups to a storage server. You'd prefer to not use simply a symmetric key for encryption, because if the machine ...
1
vote
0answers
63 views

Textbook RSA Signature attacks (without message padding)

I have been reading as much as possible, but I haven't so far found anything exactly like what I'm looking for. I have a couple of questions (given what I know below): One, is it possible to find d? ...
0
votes
2answers
71 views

Can a digital signature scheme also be an encryption scheme?

Using Schnorr signatures, one could devise a system where a single public key can represent multiple signers. Do signature schemes like that represent crypto systems usable for encryption? In that ...
1
vote
2answers
63 views

Encrypting current time using 3DES as a signature

I came across a peculiar system for generating "signatures" ("signatures" is within quotes because this is a bad use of 3DES) in the wild. It works as follows: a symmetric key is generated and used ...
0
votes
0answers
26 views

Adding new participants to a multiparty signature scheme

I'm looking for a signature scheme that allows a group of N parties, without the help of a trusted dealer, to: Jointly create a group public key $P$ Produce a valid signatures for an arbitrary ...
2
votes
1answer
50 views

is the functional signature result relies on f(x) or on x where x is a message and f is a function?

I am new on cryptography and I have a question about the functional signature scheme. The notion was introduced in this paper. In a functional signature scheme, there is a standard signature and ...
1
vote
2answers
93 views

Point of Diffie-Hellman key exchange when public keys are known [duplicate]

Since the basic version of Diffie-Hellman key exchange protocol is vulnerable to Man In The Middle Attack, some sort of authentication is needed. It was mentioned that RSA digital signature can be ...
2
votes
1answer
50 views

What is the relationship between a NIZK protocol and a digital signature scheme?

I am reading about the Fiat-Shamir heuristic to take a $\Sigma$-protocol into a non-interactive zero-knowledge proof (NIZK). I am now wondering whether there is a relationship between a NIZK proof and ...
1
vote
1answer
38 views

MAC and signatures

A message accompanied with a digital signature and a MAC. are there any possibility to know that the digital signature and the MAC are generated from the same message?
2
votes
0answers
34 views

Creating ECC Signature - Is “R” necessary in calculating “S”

After going through the mathematical proof in confirming ECDSA, it doesn't seem apparent to me that "R" is necessary in calculating "S" for the signature. In other words, what's the problem with ...
0
votes
0answers
31 views

Composite multiple signatures

Could you please tell me if there are any signature schemes that allow to aggregate multiple signatures generating using the same private key?
0
votes
1answer
48 views

Signing with RSA-SHA256 algorithm using EC keys

Is it practical to sign a data using RSA-SHA256 algorithm with EC keys? I used a small NodeJS script and crypto module (uses openSSL internally) to test this and I could successfully sign the data ...
0
votes
1answer
56 views

ECDSA signing and verification between Python and JS [closed]

I'm trying to have Python (2.7) and JS solutions for ECDSA signing (with secp256k1 curve) where ideally signatures generated by one side can be verified by the other. For the python side, I'm using ...
1
vote
1answer
61 views

Implementing a zero-knowledge proof [duplicate]

I'm trying to get my head around zero-knowledge proofs and my definition of a zero-knowledge proof is as follows. A zero-knowledge proof is a method by which one party can prove to another party ...
0
votes
0answers
37 views

How computationally heavy these algorithms?

I want to use Signal protocol to encrypt sensors data. As we know sensors have limited memory, CPU power, and battery. And Signal protocol has the following processes: Encryption: AES in CBC mode and ...
0
votes
0answers
9 views

Difference between strongness and unverifiability properties in designated verifier signature

A strong verifier designated signature has the strongness and unverifiability properties but I don't really understand the strongness property. Is strongness related to unverifiability or are they ...
1
vote
0answers
15 views

Can the precompiles in Ethereum Byzantium for pairings be used for implementation of BBS group signature verification?

I'm currently implementing a group signature verification on Ethereum and it seems that the Pairing check can only return a boolean. According to the BBS algorithm, to validate a signature $s$, you ...
1
vote
1answer
65 views

What signature aggregation schemes support valid single signature is exist in aggregation signature?

For example, there are three signers, A, B, C: A: PK(a) SK(a) MessageA SignatureA B: PK(b) SK(b) MessageB SignatureB C: PK(c) SK(c) MessageC SignatureC and ...
1
vote
0answers
46 views

ECIES Authentication

In the ECIES scheme, the sender generates an ephemeral public key per each message it encrypts. This public key, together with the receiver's private key, is used in order to generate a shared secret ...
0
votes
0answers
68 views

ECDSA signature uniqueness

I've been trying to replicate an ECDSA signing process that a cryptosystem uses (EOS, in this case), and I've been having issues. Namely, testing my c++ code (which uses openSSL) and comparing the ...
0
votes
0answers
28 views

Observable Signer Timelock

I want to design a system able to generate private/public keys where as system owner I should be able to know and share immediately the public part but for the private this must be revealed only after ...
4
votes
2answers
116 views

Atomic multi-party commitments

Alice and Bob publicly choose the messages $M_A$ and $M_B$ and independently sign them (Alice privately signs $M_A$, Bob signs $M_B$). Now Alice and Bob are looking for a protocol that allows them to:...
0
votes
0answers
26 views

Elgamal verification scheme?

According to Elgamal signature scheme; The verification process as following: the verifier determine whether or not the following condition apply $g^h(m)$=$y^r$$r^s$ mod p. where: $y$ is the public ...
3
votes
0answers
136 views

Security analysis for a extended ElGamal Signature against selective unforgeability

Let $H$ is a cryptography hash function and $\Pi=(\mathsf{G}, \mathsf{S}, \mathsf{V})$ is a digital signature, as follows: $(h_1=g^x,h_2=g^y) \leftarrow \mathsf{G}(1^n)$, where $x,y$ uniformly ...
1
vote
1answer
105 views

What cryptography primitives can help me (generate unforgeable tag)?

I have a read-only public bulletin board that It contains a series of information to form: $$[(a_1,g^{a'_1 \cdot m}), (a_2,g^{a'_2 \cdot m}), \cdots ,(a_n,g^{a'_n \cdot m})] \ ,$$ where $a_i\in\{0,1\}^...
1
vote
0answers
61 views

Signed XML SignatureValue element value (hash in base64) contains &#xd

My application is .NET based. I have signed xml from third-party environment (Java based). Its signature value base64 string contains carriage return #xd;. ...
1
vote
1answer
48 views

What scalars produce the wrong values with X25519's montgomery ladder?

This question is a consequence of an older one about multiplying a twisted Etwards point in Montgomery space. Turns out that this is unsafe in some circumstances. The following Montgomery ladder as ...
2
votes
0answers
41 views

Ed25519 threshold signature verification without knowing the single personal public keys

I read about ways to create a t-of-n threshold signature, corresponding to a collective public key of n players. (https://tools.ietf.org/html/draft-ford-cfrg-cosi-00 and Does Ed25519 support ...
0
votes
0answers
26 views

Can someone give an example of no-message attack>

I know that a no-message attack IS THAT if the adversary has access to a signing oracle and a public key, he can sign an arbitrary message. So can someone give an example of this kind of attack?
1
vote
0answers
31 views

A qusetion about the security game of Certificateless signatures

Recently I read Certificateless Public Auditing for Data Integrity in the Cloud , I have a question about the security of proposed HOMOMORPHIC AUTHENTICABLE CLS. (Sec. IV). For the Type-I Adversary, ...
0
votes
1answer
53 views

How could an offline app verify a signature from one of many private keys?

I have a situation where an offline app needs to be able to verify whether some data was created by a set of privileged users of the app. These privileged users will each have one private key of some ...
2
votes
1answer
305 views

Is every bytestring a valid Ed25519 private key?

In other words, is it a bad idea to simply do this? signingkey = crypto_random_bytes(); verifykey = Ed25519.verifykey_from_signingkey(signingkey); Are there weak ...
0
votes
0answers
48 views

Is SPHINCS signature secure?

https://eprint.iacr.org/2018/102.pdf offers possible attack against SPHINCS. How reasonable it is and which post-quantum signatures remains secure?
1
vote
1answer
71 views

Schnorr Pubkey Recovery

As per How does recovering the public key from an ECDSA signature work? , it's possible to recover public keys from ECDSA signatures. Is this possible for EC-Schnorr signatures as well? I'm looking ...
0
votes
0answers
39 views

Authenticated undistributable proof-of-work

I'm looking for a proof-of-work scheme with the following properties: It should be possible tell that the work was performed by the holder of private key $x$ Holder of $x$ should not be able to ...
0
votes
2answers
65 views

Public-key generation - primes reuse

Given the following Trap-door Commitment scheme Secret key receiver: $x_B \in_u Z_q$ Public key receiver: $y_B = g^{x_B} \mod p$ Here, $p=q*k+1$ for two primes $p,q$ and $k \in Z$. And $g$ is the ...
5
votes
1answer
76 views

Using nested signatures to trust public key of inner signatures

I have a scenario where entity $A$ has an unauthentic copy of the public key $P_B$ of $B$ and an authentic copy of $P_C$ of $C$, trusted by both $A$ and $B$. Now $A$ wants to establish trust in $P_B$...
2
votes
0answers
24 views

Avoiding multiple use of sIgned identities while not learning anything about them

There is an authority A with an associated public/private key pair (A.priv, A.pub). A can issue new "identities" by signing data (numbers or bytestrings). Each number associated with a signature by A ...
3
votes
1answer
91 views

ECIES: ECDSA with Kmac and without MAC

I have couple of questions about ECIES. I understand how ECIES work and what I must do if I want to have ECIES with ECDSA for authentication (I understand that for full authentication I have to have ...
0
votes
0answers
42 views

Derive anonymous dsa key-pair from two certificate authorities

Is it possible to derive a dsa key-pair based on two private keys from different/independent "Certificate Authorities" (ca1 and ca2) to sign s.th. which then verifies only that the signature is a ...
2
votes
2answers
156 views

ECIES with ECDSA

I understand how ECIES work. I have a structure of message [alice`s ephemeral public key, MAC tag, ciphertext] I do not understand what I shoud do if I want to ...
0
votes
0answers
24 views

Threshold signature scheme with combiner outside the group

Assume we have a (t,n) threshold signature scheme in which the secret key is shared between the n group users. If at least t users sign a certain message . Can we build the scheme in such away ...