Questions tagged [signature]

Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

224 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
8
votes
0answers
168 views

Are there conventions for signing JSON as a tree, to allow proofs of signed subtrees?

Given some JSON with a chosen encoding, you can obviously cryptographically-sign the whole thing as a binary blob. However, it might be useful if the logical structure of the JSON-compatible object ...
8
votes
0answers
178 views

Replacing signer with simulator

Assume we can prove the security of the digital signature scheme against key-only (no message) attacks. Now we want to prove security against adaptive chosen message attack. We use the random oracle ...
6
votes
0answers
92 views

Understanding anonymous credentials. Does someone understand how it works?

After reading a series of papers CL01 CL02 CL04, I feel like I understand the intuition behind the anonymous credential framework but I don't understand some details the mathematics behind it. I ...
6
votes
0answers
102 views

Is it possible to derive a homomorphic signature from homomorphic encryption

At the moment I am trying to find a practical way to implement a linearly homomorphic signature. Background: "In a homomorphic signature scheme, a user Alice signs some large dataset x using her ...
5
votes
0answers
80 views

Is qTesla Secure?

qTesla is a signature scheme and a submission to the NIST post-quantum standardization process, which made it to the second round. It is based on the hardness of RLWE. The NIST round 2 status report ...
5
votes
0answers
336 views

Difference Between an Authentication Token and an OTP (One Time Password)

I would like to better understand why some people use the term One Time Password and other Authentication Token. I have noticed that in academic circles, there is a differentiation between ...
5
votes
1answer
175 views

How to sign commited group elements?

I'm actually searching some particular primitive compatible with Groth-Sahai commitment. I would like to know a signature scheme (on group elements), such that there exists an algorithm $\mathtt{...
5
votes
0answers
129 views

Why is it safe to generate the secret key and masking vectors using rejection sampling in CRYSTALS-Dilithium?

In CRYSTALS-Dilithium module lattice-based digital signatures, the secret key vectors $s_1, s_2$ with coefficients in $[-\eta, \eta]$ and the signature masking vector $y$ with coefficients in $(-\...
5
votes
0answers
93 views

Which organization is responsible for certifying a TSA?

I see there a number of free TSA services according to this page (not all are still in service). In other sources I see references to the requirement of audits for the TSA to be 'rfc3161 compliant'. ...
5
votes
0answers
283 views

What public-key encryption protocol can use the same key pair as ECDSA?

Assume we wanted to use the same ECDSA public/private key pair (drawn for standard ECC parameters, perhaps P-256) for both its intended use (public-key signature), and for public-key encryption; this ...
5
votes
1answer
139 views

Can a PGP subordinate key be used as a web of trust signing key?

I already understand the desire to segregate a PGP master key from subkeys, allowing me to keep the master key in some off-site non-networked location while making use of the subkeys to do things like ...
5
votes
0answers
820 views

How to prove that a commitment hides the decryption of an ElGamal ciphertext?

I've decided to remove a previous unanswered question of mine and break it down into smaller pieces so it's not such a loaded question. For this question I need to prove that I've committed to a ...
4
votes
0answers
619 views

RSASSA-PSS in TLS 1.2

I know it is possible to use RSASSA-PKCS1-v1_5 with client certificates in TLS 1.3. But what about the other way around: using RSASSA-PSS with client certificates in TLS 1.2? Is it possible to use ...
4
votes
0answers
174 views

Using cryptography: How to handle this real life situation?

For my class in applied information security I'm asked to find a cryptographic solution to the following problem: The government of country X wants to simplify the process of issuing driving ...
4
votes
0answers
345 views

Can CKM_RSA_PKCS signature be made secure by lowering its maximum input size?

The CKM_RSA_PKCS Mechanism in PKCS#11 is a signature scheme commonly used to implement RSASSA-PKCS1-v1_5 of PKCS#1 for data hashed externally to a PKCS#11 token (such as an HSM). Basically it is the (...
3
votes
0answers
75 views

"Electronic signature" legal definition

A proposed California law contains the following definition: (i) “Electronic signature” means an electronic sound, symbol, or process attached to or logically associated with an electronic record and ...
3
votes
0answers
36 views

parameter estimating in lattice signature scheme

when reading [BDLOP18], I run the lwe-estimator with the recommended parameters in Table 2 , but the result of hermite factor is 1.007, this result is bigger than the recommended hermite factor 1.0035
3
votes
0answers
113 views

What short signature standard?

In some applications like QR-codes, saving 25 bytes out of 100 makes a difference in usability. What choice is there for a signature scheme with (most important criteria first) As small as possible ...
3
votes
0answers
206 views

Uniqueness and Schnorr signatures

I am trying to analyse a "uniqueness" game around Schnorr signatures. The game is described in $\textbf{B.}$ and I try to provide in $\textbf{1.}$ and $\textbf{2.}$ some incomplete answers ...
3
votes
0answers
91 views

Which parts of CRYSTALS-Kyber and CRYSTALS-Dilithium are compatible?

The papers CRYSTALS-Kyber and CRYSTALS-Dilithium both have been written by quite different authors. It seems that at least the key generation is very different from each other. CRYSTALS mainly seems ...
3
votes
0answers
129 views

How can the Number Field Sieve attack the discrete log in $\mathbb Z_p^*$ of DSA?

The Digital Signature Algorithm (DSA) uses $L$-bit prime $p$ and $N$-bit prime $q$ with $q| p-1$, i.e., $p = r\cdot q +1$ ( Schnorr group if $r>2$ and safe prime if $r=2$). In a way, the security ...
3
votes
0answers
87 views

Using (EC)DH to generate a signature

Say I have access to a system A that is limited to performing (EC)DH, followed by key derivation to produce a secret key. This secret key is later used to provide integrity protection. There is a ...
3
votes
0answers
34 views

How many signatures can a signing key (safely) produce

Given an AES key, there is a limit (of about $2^{64}$ blocks) of how much plaintext it is safe to encrypt with the key. Is there a similar limit for how many signatures it is safe to produce with a ...
3
votes
0answers
180 views

Is BLS signature still conjectured to achieve $b$-bit security for $2b$-bit appendix?

The BLS signature scheme [1] promised $b$-bit security for signature with a $2b$-bit appendix, under classical hypothesis leaving aside the possibility of Quantum Computers usable for cryptanalysis. ...
3
votes
0answers
652 views

How to determine the correct padding to use for rsa signing?

Before today I didn't know the difference between RSA padding for encryption and for signing, I think this answer describes it pretty succinctly, however, I don't know if there is an optimal padding ...
3
votes
0answers
70 views

What type of attacks are practical for this situation?

Here is the details: I found a web api while pentesting for a company which I cannot disclose and while doing so I found a API which signs a request of the users choice, but it adds a tag to the top ...
3
votes
0answers
134 views

What's the minimum message expansion for Digital Signature?

Can we prove a minimal message expansion for a Digital Signature scheme (possibly with Message Recovery), for $b$-bit security (that is expected $O(2^b)$ work to break the system)? Define message ...
3
votes
0answers
63 views

How can I obtain a code with same weight codewords?

I want to implement "A new one-time signature scheme from syndrome decoding". My first challenge is how to obtain $P$. $P$ is a generator matrix whose codewords have weight not exceeding an integer ...
3
votes
0answers
324 views

How are Zhang-Safavi-Susilo signatures short?

ZSS signatures have been introduced by Fangguo Zhang, Reihaneh Safavi-Naini, and Willy Susilo: An Efficient Signature Scheme from Bilinear Pairings and Its Applications, in proceedings of PKC 2004. ...
3
votes
0answers
163 views

Authenticated encryption with Enc-Sign-Mac

I've given a CPA secure private key encryption scheme, an unforgeable private key MAC scheme and an unforgeable public key signature scheme. I want to combine them to protect confidentiality, ...
3
votes
0answers
488 views

Limit the number of private key uses for RSASSA-PKCS1-v1_5 with SHA-256 signature?

Assuming all messages and their signatures are available to the attacker, is it secure to use the same RSA private key to sign many messages (roughly $10^{6}$) via PKCS#11 ...
3
votes
0answers
123 views

Residue requirements of Rabin-Williams primes?

I'm trying to determine the residue requirements of Rabin-Williams. An older copy of P1363's Public Key Cryptography states the following in Section 8.1.3.2 RW key pairs: An RW public key consists ...
3
votes
0answers
247 views

Signature verification with only hash (without full data)

I am looking for a way to sign a file, such that someone else can verify that I had this file, even if they only know a hash. I want to prove that I have the full file to someone who only has the hash....
2
votes
0answers
31 views

Why does OAuth 1.0a require random nonces and how random should they be?

What are the requirements of a nonce? <- Typically it is only required that a nonce is unique, however, in certain cases harsher requirements (such as randomness and unpredictability) are put. The ...
2
votes
0answers
30 views

Designated verifier signature from Diffie–Hellman and a MAC

Here is an idea for a designated verifier signature scheme. Suppose Alice and Bob know each other’s public keys and Alice wants to send a message to Bob, such that only he will be convinced of its ...
2
votes
1answer
75 views

kleptography SETUP attack in ecdsa

I'm trying to implement kleptography SETUP attack of ecdsa with python. Just a simply script to verify the algorithm. However i can't get the right output as the paper said. Where is the problem? Can ...
2
votes
0answers
42 views

Basic explanation of Falcon and Dilithium

I've been trying to search for toy examples of the round 3 digital signatures Rainbow, Falcon and Dilithium. Not a lot of actual implementation examples are out there. What I'm searching for are ...
2
votes
0answers
35 views

Can one prove that a particular public key is part of an aggregated (MuSig) public key?

The MuSig paper (2018) describes a Schnorr signature key aggregation scheme which lets a set of individual public keys to be merged into a single, "aggregated" public key. In the protocol ...
2
votes
0answers
31 views

Does having CDH oracle breaks El-Gamal signature scheme?

Having a oracle that solves Computational Diffie-Hellman problem which for given values $(g, g^a, g^b)$ outputs $g^{ab}$, is it possible to forge a signature in El-Gamal (wiki) signature scheme?
2
votes
1answer
79 views

Names and games for security properties preventing substitution of signed message by the signer

Some signature schemes, notably ECDSA, unwillingly allow users to prepare their public/private key pair as a function of two arbitrary messages of their choice, and compute a signature that checks for ...
2
votes
1answer
48 views

Efficient peer to peer untrusted signature aggregation

Suppose I had a peer to peer system, there are a few writers with the same signing key, and all readers have the verification key. A naive system is that each document $d_1..d_n$ gets signed $s_i=sign(...
2
votes
0answers
27 views

Threshold Signature with Accumulation Scheme?

Is there a threshold signature scheme that can be accumulated? That is, given a message $M$ signed by $k-1$ parties and the $(k-1)$-threshold signature $\sigma_{k-1}$, a party can verify $\sigma_{k-1}$...
2
votes
0answers
77 views

Question about using isogenies to mask elliptic pair

For this question I'm referring to the ed25519 algorithm In blockchain one project (Monero) shot itself in the foot a while back by having senders derive public keys from an ed25519 pair, by ...
2
votes
0answers
42 views

How can one-way hash functions in the signatures help by using same algorithm for encryption and signature verification?

I read some documents about digital signatures and one way hash functions, etc., but everything was too complicated and I don't have much experience in cryptography. Can anyone explain to me in a ...
2
votes
0answers
30 views

Has the security of the IBS scheme suggested by Shamir in 1984 ever been proven?

My question is about the original IBE proposal by Shamir from 1984: https://link.springer.com/content/pdf/10.1007/3-540-39568-7_5.pdf In addition to proposing the idea of IBE, it also proposes a ...
2
votes
0answers
94 views

How reliable is sagecipher?

Recently I found the sagecipher project, which uses ssh-agent's signing operation as a way to produce a symmetric key and encrypt data with it. It appears to work with ssh-ed25519 keys, but my ...
2
votes
0answers
121 views

GPG should you double sign?

This is not a question about whether I should encrypt or sign first, as I've read here. Rather, it's about whether I should sign, then encrypt, then sign again. Because as far as I know, there is no ...
2
votes
0answers
81 views

Why Fiat-Shamir based signatures incur a security loss?

I read here that assuming we have a Fiat-Shamir (FS) signature $\Sigma$ that is secure based on the hardness of a particular hard problem $\Pi$. Then, the security proof of $\Sigma$ in the classical ...
2
votes
0answers
82 views

Avoid storing the whole message when signing with SPHINCS+

Unlike pretty much every other signature scheme that I am aware of (excluding Picnic, the original SPHINCS, and SPHINCS-gravity) SPHINCS+ requires that the whole message be available during the ...
2
votes
0answers
131 views

Elgamal security if same key used twice

Assume that user A sends to user B a message, unencrypted, and signs it with an Elgamal signature. Can some adversary, call it C, who eavesdrops, learn the private key if user A signed both messages ...

1
2 3 4 5