Questions tagged [signature]

Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

Filter by
Sorted by
Tagged with
1
vote
2answers
164 views

Is the verification process in ECDSA the same or different from in RSA?

With an RSA key pair, from my understanding, Alice who holds the private key is able to encrypt a message into a signature. She would then send the signature together with her original message to Bob. ...
0
votes
1answer
30 views

Is there any link between group signature and multi-signature

Are both of these concepts related in someway. Can a group signature scheme be transformed into a multi-signature scheme?
1
vote
1answer
62 views

Is digital signature without schema possible?

In my application I want to use Rabin crypto system with short keys (like 128 bits) and MD5 for hashing. I found that schema like PKCS1-V1_5 or PPS does not allow you to have such small keys and ...
1
vote
0answers
13 views

Can we use an Identity-based signature for identity authentication?

This is clear to me that message authentication is provided by a signature scheme. Can we use an Identity-based signature for identity authentication?
-3
votes
1answer
67 views

Show me all the steps and methods used to get from a system of 4 linear equations to solve for X1 and X2

I am looking at an answer to a previous question and I would like more detail about how the answer was arrived at but I am not allowed to comment as I am a new user with low points. I am therefore ...
2
votes
0answers
42 views

Basic explanation of Falcon and Dilithium

I've been trying to search for toy examples of the round 3 digital signatures Rainbow, Falcon and Dilithium. Not a lot of actual implementation examples are out there. What I'm searching for are ...
1
vote
0answers
39 views

hash functions and unconditional security

To the extent of my knowledge, hash functions are based on computational complexity (and not on physical laws of quantum mechanics). So they can not provide unconditional security. But, are there hash ...
3
votes
1answer
166 views

Why check for point-at-infinity during ECDSA verification?

The ECDSA standard mandates that during verification we check that an intermediate calculation does not lead to the point-at-infinity (see Step 5. in this summary on Wikipedia ). But why do we check ...
1
vote
0answers
48 views

Is there a zero knowledge proof of knowledge of a Waters sigature?

I am looking for a ZK PoK of a digital signature. I have seen constructions that work for ElGamal signatures (see this older paper), but need to work with Waters signatures, as described here. Has ...
3
votes
0answers
206 views

Uniqueness and Schnorr signatures

I am trying to analyse a "uniqueness" game around Schnorr signatures. The game is described in $\textbf{B.}$ and I try to provide in $\textbf{1.}$ and $\textbf{2.}$ some incomplete answers ...
1
vote
0answers
38 views

Should strong RSA key with SHA1 self-signature in public key to be considered weak?

Older RSA-4096 GPG keys generated when SHA1 still thought to be acceptable have public key self-signed with SHA1. Shall this considered to be weak key? And with what arguments? AFAIK, GPG key ids are ...
2
votes
1answer
79 views

What benefit is gained when combining AES GCM/GMAC with ECDSA?

This is a real world question (and as I'm not an expert in cryptography I have only some basic knowledge in terms of just using it, not a deep understanding how ist works under the hood.): A system ...
1
vote
1answer
36 views

How was the adversary's success probability calculated in this 2002 paper by Dodis, Katz, Xu, Yung about key-insulated signature schemes?

In this paper ("Strong key insulated signature schemes" by by Dodis, Katz, Xu, Yung (2002)), I understand most of the proof for Lemma 1 (pg. 9); I struggle with how some of the probability ...
0
votes
1answer
81 views

Can I copy digital signature for malicious purpose?

I am reading Cryptography. I have multiple questions to ask. I signed my QR code with my private key so that people can verify it's mine. QR code has data which is public. I have this QR code on my ...
2
votes
1answer
56 views

Early field use of digital signature

What are documented early field uses of digital signature? The oldest I found is reported by Charles H. Bennett, Gilles Brassard, Seth Breidbart, Stephen Wiesner's Quantum Cryptography, or Unforgeable ...
2
votes
2answers
56 views

Security of Signature Schemes in the Multi-User Setting

I've often read about the security of a signature scheme in the multi-user setting Link1 Link2, but I couldn't find a real definition. I would like to be sure that I understand it correctly. So my ...
0
votes
1answer
42 views

Related Key Attack on Schnorr Signature - Why does the challenge include $\psi = g^x$, not $y$?

The original Schnorr signature scheme suffers from a Related Key Attack (RKA) as described by Morita et al. The authors of this paper then suggest a modification to the signature algorithm to prevent ...
0
votes
1answer
53 views

How many valid signatures can the same message have using ElGamal?

I know that messages in ElGamal are not deterministic, so a message can have more than one valid signature. But is the number of valid subscriptions infinite?
0
votes
2answers
2k views

Counterfeit EU Green Passes

In the EU, a person will soon be able to perform certain activities (going to concerts, to sports events, etc.) only if they can present a valid Green Pass that certifies that the bearer has been ...
1
vote
0answers
20 views

Can the hash of a PKCS1 v1.5 RSA signature be used as a key derivation function?

I know this sounds crazy, but hear me out. As a follow-up to Can the AES-GCM authentication tag be used as a key derivation function?, I'm also considering more creative solutions to derive unique (...
1
vote
1answer
23 views

How to determine curve's field size in a ECDSA Signature

There is a bug in some firmware I'm working that states the following: If individual coordinates are shorter or longer than the curve’s field size they are processed incorrectly. So I can get the ...
2
votes
1answer
52 views

How much much data can be verified by an electronic signature?

I’m trying to get a good understanding of how data encryption and signing work. I imagine these vary a bit depending on the software being used. In particular, I am wondering about this: how much data ...
-1
votes
1answer
97 views

How to encrypt using private key for ECC

As we know, ECC using $C_2 = r \cdot G, C_1 = M + r \cdot G$; and decrypt with $M=C_1 - K \cdot C_2$. And sign using point $X$: $X = k \cdot G(x_0,y_0)$. $r = x_0 \cdot K; s = 1 / k \cdot (M + r \cdot ...
2
votes
1answer
51 views

How do I construct the Fn family of functions of WOTS+ using SHA3?

From the WOTS+ paper: Furthermore, W-OTS+ uses a family of functions Fn : {f_k : {0, 1}^n → {0, 1}^n | k ∈ Kn} with key space Kn. The reader might think of it as a cryptographic hash function family ...
3
votes
1answer
129 views

Is NOTS a valid one time signature scheme?

I've just learn about NOTS, a quantum-resistant signature scheme based on hash functions that claims to have much shorter signature and key sizes. Is this signature scheme known to be secure? From ...
2
votes
0answers
35 views

Can one prove that a particular public key is part of an aggregated (MuSig) public key?

The MuSig paper (2018) describes a Schnorr signature key aggregation scheme which lets a set of individual public keys to be merged into a single, "aggregated" public key. In the protocol ...
0
votes
0answers
20 views

Prepare signing/verifying module from node js crypto

I'm working on a node crypt module that will signing/verifying. I have managed the verifying module: ...
0
votes
0answers
31 views

Algorithm to ensure m people signed off on a task out of a group of N

I have a task that needs M people to approve out of a group of N. I can obviously implement it in software using a basic ECC signature mechanism. The code on the "server" can send request ...
0
votes
1answer
64 views

Required certificate key usage for signing document

What's the required key usage/extended key usage for signing documents, eg.PDF, Word, PowerPoint, Excel, etc... I am going to create a self-signed certificate that is needed to sign those documents. I ...
3
votes
3answers
155 views

Can you create an encryption algorithm from a signing algorithm, or vice versa?

I remember reading, a few years ago, that you couldn't prohibit encryption without prohibiting signing, as you can always make a public key encryption algorithm from a signing algorithm. (It might be ...
0
votes
0answers
30 views

How does the public-key generation work in the multivariate post-quantum digital signature GeMMS?

There are a few steps in the public-key generation of GeMSS that I am trying to understand. The first is the below equations (1). What does "$\theta_i$ forms a basis for $\mathbb{F}_{2^n}$ over $\...
4
votes
2answers
852 views

What does existential unforgeability mean in a digital signature scheme?

In a digital signature scheme (Gen, Sign, Verfiy) that satisfies correctness and existential unforgeability, can you assume that the outputs of Sign() are computationally indistinguishable from random?...
0
votes
0answers
22 views

Existential unforgabilty of a separately signed message

Assuming I have a valid signature scheme, and modify it like: m = m0 || m1, and output Sign(sk, m0) || Sign(sk, m1). While it is correct, would this violate existential unforgability?
1
vote
0answers
27 views

Is there a robust Identity-Based Digital Signature algorithm?

I'm looking for a IB-DS algorithm in the web. I found this one (if you know some other let me know). But I cannot figure out what the "identity" is. Better: I don't know if, in the section ...
2
votes
0answers
31 views

Does having CDH oracle breaks El-Gamal signature scheme?

Having a oracle that solves Computational Diffie-Hellman problem which for given values $(g, g^a, g^b)$ outputs $g^{ab}$, is it possible to forge a signature in El-Gamal (wiki) signature scheme?
2
votes
1answer
79 views

Names and games for security properties preventing substitution of signed message by the signer

Some signature schemes, notably ECDSA, unwillingly allow users to prepare their public/private key pair as a function of two arbitrary messages of their choice, and compute a signature that checks for ...
1
vote
1answer
40 views

What's the use of SHA on Non Digital Signature applications?

What's the use of SHA on Non Digital Signature applications? Why is SHA1 not a risk for Non Digital Signature applications? What's the difference between Non Digital Signature applications vs. Digital ...
6
votes
1answer
153 views

Is there any cryptographic reason to sign over the signature algID and params?

It seems to be common-practice for a signature protocol to include the algorithmID and params (if any) in the data being signed. For example: RSA PKCS#1 v1.5 includes the digest alg in the data being ...
0
votes
0answers
29 views

How about, when using public key cryptography, one encrypts, signs, and encrypts again?

I suppose one reason for prepending the name would be that a malicious Bob could pose as Alice by encrypting the exact same message + Alice's signature using Charlie's public key, and trick Charlie ...
0
votes
1answer
71 views

Would generating the 'digital signature' of a very short message be less work if you encrypted the message instead of it's hash?

Imagine one's computer clearsigned a message by encrypting the message with one's private key and storing the two (the plaintext and the ciphertext) together in a folder (and publishing the public key)...
1
vote
0answers
37 views

Hashing Public Key of Lamport or Winternitz OTS

For the Lamport or Winternitz public keys, couldn't one just hash down the large public key to 256 bits in order to greatly reduce the public key size while still having basically the same security? ...
0
votes
0answers
38 views

Is there a name for this simple identity verification scheme?

Once, while idly wondering, I came up with a simple scheme to prove the authenticity of a chain of messages given the authenticity of the first. It consists of putting a hash at the end of each ...
3
votes
0answers
91 views

Which parts of CRYSTALS-Kyber and CRYSTALS-Dilithium are compatible?

The papers CRYSTALS-Kyber and CRYSTALS-Dilithium both have been written by quite different authors. It seems that at least the key generation is very different from each other. CRYSTALS mainly seems ...
0
votes
0answers
67 views

Given N and e in RSA and the ability to get signature s for any message m, can you find the value of the private key d?

Given N and e in RSA and the ability to get signature s for any message m ($s=m^d \mod{n}$), can you find the value of the private key d?
1
vote
0answers
21 views

What are some major applications of Identity based signatures (IBS) in real life?

I read about Identity Based Signatures this week. I was thinking about its application in major fields like IoT etc. Are there any such applications? For example: Multi-signature have application in ...
2
votes
1answer
87 views

Can Alice prove that she *did not* send an unsigned message to Bob?

Suppose Alice wants to send messages to Bob. However she doesn't trust Bob. She believes that Bob may publicly disclose a fake message, claiming that it came from Alice. This message will cause the ...
2
votes
1answer
48 views

Efficient peer to peer untrusted signature aggregation

Suppose I had a peer to peer system, there are a few writers with the same signing key, and all readers have the verification key. A naive system is that each document $d_1..d_n$ gets signed $s_i=sign(...
1
vote
1answer
43 views

What salt should be used when generating TLS 1.3 CertificateVerify message?

When signing handshake messages digest, the MGF1 function takes some salt value with same length as the digest has. But what content must be in salt's buffer? I explored the source code of libnettle, ...
0
votes
0answers
25 views

XMSS vs MSS (Motivation)

I was reading XMSS and I watched some of the presentations about it by Dr. Andreas Hülsing. But I cannot underdstand what is our motivation to use XMSS with 1 layer. Why is it better than MSS? I know ...
3
votes
1answer
263 views

Is this pairing-based signature scheme secure?

There are a number of signature schemes on small domains based on bilinear pairings which do not use random oracles. Examples are the Boneh-Boyen schemes and an interesting one from Okamoto which ...

1
2
3 4 5
25