Questions tagged [signature]

Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

213 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
8
votes
0answers
166 views

Are there conventions for signing JSON as a tree, to allow proofs of signed subtrees?

Given some JSON with a chosen encoding, you can obviously cryptographically-sign the whole thing as a binary blob. However, it might be useful if the logical structure of the JSON-compatible object ...
8
votes
0answers
176 views

Replacing signer with simulator

Assume we can prove the security of the digital signature scheme against key-only (no message) attacks. Now we want to prove security against adaptive chosen message attack. We use the random oracle ...
6
votes
0answers
80 views

Understanding anonymous credentials. Does someone understand how it works?

After reading a series of papers CL01 CL02 CL04, I feel like I understand the intuition behind the anonymous credential framework but I don't understand some details the mathematics behind it. I ...
6
votes
0answers
100 views

Is it possible to derive a homomorphic signature from homomorphic encryption

At the moment I am trying to find a practical way to implement a linearly homomorphic signature. Background: "In a homomorphic signature scheme, a user Alice signs some large dataset x using her ...
5
votes
0answers
276 views

Difference Between an Authentication Token and an OTP (One Time Password)

I would like to better understand why some people use the term One Time Password and other Authentication Token. I have noticed that in academic circles, there is a differentiation between ...
5
votes
0answers
122 views

Why is it safe to generate the secret key and masking vectors using rejection sampling in CRYSTALS-Dilithium?

In CRYSTALS-Dilithium module lattice-based digital signatures, the secret key vectors $s_1, s_2$ with coefficients in $[-\eta, \eta]$ and the signature masking vector $y$ with coefficients in $(-\...
5
votes
0answers
92 views

Which organization is responsible for certifying a TSA?

I see there a number of free TSA services according to this page (not all are still in service). In other sources I see references to the requirement of audits for the TSA to be 'rfc3161 compliant'. ...
5
votes
0answers
274 views

What public-key encryption protocol can use the same key pair as ECDSA?

Assume we wanted to use the same ECDSA public/private key pair (drawn for standard ECC parameters, perhaps P-256) for both its intended use (public-key signature), and for public-key encryption; this ...
5
votes
1answer
124 views

Can a PGP subordinate key be used as a web of trust signing key?

I already understand the desire to segregate a PGP master key from subkeys, allowing me to keep the master key in some off-site non-networked location while making use of the subkeys to do things like ...
5
votes
0answers
795 views

How to prove that a commitment hides the decryption of an ElGamal ciphertext?

I've decided to remove a previous unanswered question of mine and break it down into smaller pieces so it's not such a loaded question. For this question I need to prove that I've committed to a ...
4
votes
0answers
524 views

RSASSA-PSS in TLS 1.2

I know it is possible to use RSASSA-PKCS1-v1_5 with client certificates in TLS 1.3. But what about the other way around: using RSASSA-PSS with client certificates in TLS 1.2? Is it possible to use ...
4
votes
0answers
118 views

What are some use cases for white-box digital signatures?

There were 2 papers published in the last year, that describe 2 different white-box identity-based digital signature schemes: White-Box Implementation of the Identity-Based Signature Scheme in the ...
4
votes
0answers
174 views

Using cryptography: How to handle this real life situation?

For my class in applied information security I'm asked to find a cryptographic solution to the following problem: The government of country X wants to simplify the process of issuing driving ...
4
votes
0answers
344 views

Can CKM_RSA_PKCS signature be made secure by lowering its maximum input size?

The CKM_RSA_PKCS Mechanism in PKCS#11 is a signature scheme commonly used to implement RSASSA-PKCS1-v1_5 of PKCS#1 for data hashed externally to a PKCS#11 token (such as an HSM). Basically it is the (...
3
votes
0answers
90 views

What short signature standard?

In some applications like QR-codes, saving 25 bytes out of 100 makes a difference in usability. What choice is there for a signature scheme with (most important criteria first) As small as possible ...
3
votes
0answers
189 views

Uniqueness and Schnorr signatures

I am trying to analyse a "uniqueness" game around Schnorr signatures. The game is described in $\textbf{B.}$ and I try to provide in $\textbf{1.}$ and $\textbf{2.}$ some incomplete answers ...
3
votes
0answers
74 views

Which parts of CRYSTALS-Kyber and CRYSTALS-Dilithium are compatible?

The papers CRYSTALS-Kyber and CRYSTALS-Dilithium both have been written by quite different authors. It seems that at least the key generation is very different from each other. CRYSTALS mainly seems ...
3
votes
0answers
118 views

How can the Number Field Sieve attack the discrete log in $\mathbb Z_p^*$ of DSA?

The Digital Signature Algorithm (DSA) uses $L$-bit prime $p$ and $N$-bit prime $q$ with $q| p-1$, i.e., $p = r\cdot q +1$ ( Schnorr group if $r>2$ and safe prime if $r=2$). In a way, the security ...
3
votes
0answers
82 views

Using (EC)DH to generate a signature

Say I have access to a system A that is limited to performing (EC)DH, followed by key derivation to produce a secret key. This secret key is later used to provide integrity protection. There is a ...
3
votes
0answers
34 views

How many signatures can a signing key (safely) produce

Given an AES key, there is a limit (of about $2^{64}$ blocks) of how much plaintext it is safe to encrypt with the key. Is there a similar limit for how many signatures it is safe to produce with a ...
3
votes
0answers
175 views

Is BLS signature still conjectured to achieve $b$-bit security for $2b$-bit appendix?

The BLS signature scheme [1] promised $b$-bit security for signature with a $2b$-bit appendix, under classical hypothesis leaving aside the possibility of Quantum Computers usable for cryptanalysis. ...
3
votes
0answers
651 views

How to determine the correct padding to use for rsa signing?

Before today I didn't know the difference between RSA padding for encryption and for signing, I think this answer describes it pretty succinctly, however, I don't know if there is an optimal padding ...
3
votes
0answers
70 views

What type of attacks are practical for this situation?

Here is the details: I found a web api while pentesting for a company which I cannot disclose and while doing so I found a API which signs a request of the users choice, but it adds a tag to the top ...
3
votes
0answers
134 views

What's the minimum message expansion for Digital Signature?

Can we prove a minimal message expansion for a Digital Signature scheme (possibly with Message Recovery), for $b$-bit security (that is expected $O(2^b)$ work to break the system)? Define message ...
3
votes
0answers
63 views

How can I obtain a code with same weight codewords?

I want to implement "A new one-time signature scheme from syndrome decoding". My first challenge is how to obtain $P$. $P$ is a generator matrix whose codewords have weight not exceeding an integer ...
3
votes
0answers
307 views

How are Zhang-Safavi-Susilo signatures short?

ZSS signatures have been introduced by Fangguo Zhang, Reihaneh Safavi-Naini, and Willy Susilo: An Efficient Signature Scheme from Bilinear Pairings and Its Applications, in proceedings of PKC 2004. ...
3
votes
0answers
163 views

Authenticated encryption with Enc-Sign-Mac

I've given a CPA secure private key encryption scheme, an unforgeable private key MAC scheme and an unforgeable public key signature scheme. I want to combine them to protect confidentiality, ...
3
votes
0answers
478 views

Limit the number of private key uses for RSASSA-PKCS1-v1_5 with SHA-256 signature?

Assuming all messages and their signatures are available to the attacker, is it secure to use the same RSA private key to sign many messages (roughly $10^{6}$) via PKCS#11 ...
3
votes
0answers
122 views

Residue requirements of Rabin-Williams primes?

I'm trying to determine the residue requirements of Rabin-Williams. An older copy of P1363's Public Key Cryptography states the following in Section 8.1.3.2 RW key pairs: An RW public key consists ...
3
votes
0answers
243 views

Signature verification with only hash (without full data)

I am looking for a way to sign a file, such that someone else can verify that I had this file, even if they only know a hash. I want to prove that I have the full file to someone who only has the hash....
2
votes
0answers
30 views

Basic explanation of Falcon and Dilithium

I've been trying to search for toy examples of the round 3 digital signatures Rainbow, Falcon and Dilithium. Not a lot of actual implementation examples are out there. What I'm searching for are ...
2
votes
0answers
28 views

Does having CDH oracle breaks El-Gamal signature scheme?

Having a oracle that solves Computational Diffie-Hellman problem which for given values $(g, g^a, g^b)$ outputs $g^{ab}$, is it possible to forge a signature in El-Gamal (wiki) signature scheme?
2
votes
1answer
73 views

Names and games for security properties preventing substitution of signed message by the signer

Some signature schemes, notably ECDSA, unwillingly allow users to prepare their public/private key pair as a function of two arbitrary messages of their choice, and compute a signature that checks for ...
2
votes
1answer
39 views

Efficient peer to peer untrusted signature aggregation

Suppose I had a peer to peer system, there are a few writers with the same signing key, and all readers have the verification key. A naive system is that each document $d_1..d_n$ gets signed $s_i=sign(...
2
votes
0answers
25 views

Threshold Signature with Accumulation Scheme?

Is there a threshold signature scheme that can be accumulated? That is, given a message $M$ signed by $k-1$ parties and the $(k-1)$-threshold signature $\sigma_{k-1}$, a party can verify $\sigma_{k-1}$...
2
votes
0answers
70 views

Question about using isogenies to mask elliptic pair

For this question I'm referring to the ed25519 algorithm In blockchain one project (Monero) shot itself in the foot a while back by having senders derive public keys from an ed25519 pair, by ...
2
votes
0answers
42 views

How can one-way hash functions in the signatures help by using same algorithm for encryption and signature verification?

I read some documents about digital signatures and one way hash functions, etc., but everything was too complicated and I don't have much experience in cryptography. Can anyone explain to me in a ...
2
votes
0answers
30 views

Has the security of the IBS scheme suggested by Shamir in 1984 ever been proven?

My question is about the original IBE proposal by Shamir from 1984: https://link.springer.com/content/pdf/10.1007/3-540-39568-7_5.pdf In addition to proposing the idea of IBE, it also proposes a ...
2
votes
0answers
82 views

How reliable is sagecipher?

Recently I found the sagecipher project, which uses ssh-agent's signing operation as a way to produce a symmetric key and encrypt data with it. It appears to work with ssh-ed25519 keys, but my ...
2
votes
0answers
104 views

GPG should you double sign?

This is not a question about whether I should encrypt or sign first, as I've read here. Rather, it's about whether I should sign, then encrypt, then sign again. Because as far as I know, there is no ...
2
votes
0answers
77 views

Why Fiat-Shamir based signatures incur a security loss?

I read here that assuming we have a Fiat-Shamir (FS) signature $\Sigma$ that is secure based on the hardness of a particular hard problem $\Pi$. Then, the security proof of $\Sigma$ in the classical ...
2
votes
0answers
76 views

Avoid storing the whole message when signing with SPHINCS+

Unlike pretty much every other signature scheme that I am aware of (excluding Picnic, the original SPHINCS, and SPHINCS-gravity) SPHINCS+ requires that the whole message be available during the ...
2
votes
0answers
91 views

Elgamal security if same key used twice

Assume that user A sends to user B a message, unencrypted, and signs it with an Elgamal signature. Can some adversary, call it C, who eavesdrops, learn the private key if user A signed both messages ...
2
votes
0answers
44 views

Errors in the RingCT 3.0 paper

I found some errors in the RingCT 3.0 paper (https://eprint.iacr.org/2019/508.pdf) in the ring signature chapter. This makes it impossible to implement this algorithm. Namely: In the chapter “C.2 ...
2
votes
0answers
179 views

Does EdDSA share Schnorr signature secure linearity property?

EdDSA, Edwards-curve Digital Signature Algorithm (EdDSA), is a digital signature scheme using a variant of Schnorr signature based on Twisted Edwards curves (source). Schnorr signatures have a ...
2
votes
0answers
80 views

Post-quantum aggregate / multi signatures

Are there any practical post-quantum aggregate / multi signatures? Currently, the aggregate / multi signature schemes seem to be limited to pre-quantum elliptic curve assumptions only, e.g., [BDN18], [...
2
votes
0answers
214 views

Creating ECC Signature - Is "R" necessary in calculating "S"

After going through the mathematical proof in confirming ECDSA, it doesn't seem apparent to me that "R" is necessary in calculating "S" for the signature. In other words, what's the problem with ...
2
votes
0answers
117 views

ECIES Authentication

In the ECIES scheme, the sender generates an ephemeral public key per each message it encrypts. This public key, together with the receiver's private key, is used in order to generate a shared secret ...
2
votes
0answers
252 views

Ed25519 threshold signature verification without knowing the single personal public keys

I read about ways to create a t-of-n threshold signature, corresponding to a collective public key of n players. (https://datatracker.ietf.org/doc/html/draft-ford-cfrg-cosi-00 and Does Ed25519 support ...
2
votes
0answers
29 views

Avoiding multiple use of sIgned identities while not learning anything about them

There is an authority A with an associated public/private key pair (A.priv, A.pub). A can issue new "identities" by signing data (numbers or bytestrings). Each number associated with a signature by A ...

1
2 3 4 5