40
votes
Accepted
ECDSA, EdDSA and ed25519 relationship / compatibility
Ed25519 is a specific instance of the EdDSA family of signature schemes. Ed25519 is specified in RFC 8032 and widely used. The only other instance of EdDSA that anyone cares about is Ed448, which is ...
- 45.6k
39
votes
Accepted
Should I use RSA encryption since RSA is said to be broken by NSA?
This question has many problems in the way it was asked, and clearly did not come after doing some investigation. However, since this seems to be a misconception that is spreading widely, I will ...
- 26.9k
37
votes
Accepted
How does recovering the public key from an ECDSA signature work?
Actually, it is not possible to uniquely recover the public key from an ECDSA signature $(r,s)$. This remains true even if we also assume you know the curve, the hash function used, and you also have ...
- 131k
37
votes
Accepted
HMAC vs ECDSA for JWT
The distinction is that ECDSA solves a problem that HMAC does not. If you need that problem solved, then you need to do ECDSA rather than HMAC; if you do not, then HMAC works just as well (and is a ...
- 131k
34
votes
Digital signature that is only verifiable by one specific person
What you seem to be looking for is deniable authentication.
This is actually a somewhat stronger property than what you're asking for: it guarantees that the recipient (let's call him Bob) cannot ...
- 44.2k
22
votes
Accepted
Curve25519 over Ed25519 for key exchange? Why?
There's a few different related parts here, and the nomenclature of the library you've cited is a little confusing.
Curve25519 is an elliptic curve over the finite field $\mathbb F_p$, where $p = 2^{...
- 45.6k
21
votes
Accepted
What is the intuition for ECDSA?
It is possible to view DSA/ECDSA as an identification scheme (like Schnorr) but with a different variant of Fiat-Shamir. This gives the intuition that you are perhaps looking for. I will include an ...
- 26.9k
20
votes
ECDSA Signature R|S to ASN1 DER Encoding question
The ASN.1 DER format is deterministic; i.e. there is only a single sequence of bytes that validly encodes given $r$ and $s$ values. Mind the details, though: the encodings of $r$ and $s$ are minimal-...
- 84.5k
20
votes
Accepted
What is the difference between ECDSA and EdDSA?
Partially covered by does TLS 1.3 use ECDSA-Sig-Value encoded signatures for Ed25519 / Ed448? but to add a little, rfc8032 describes EdDSA's advantages as:
EdDSA provides high performance on a ...
- 5,391
18
votes
HMAC vs ECDSA for JWT
To add to poncho's answer (since they beat me to it!), there are several advantages to choosing HMAC over ECDSA (or RSA) if you can get away with it:
Insanely better performance: signing and ...
- 2,706
17
votes
Can deterministic ECDSA be protected against fault attacks?
As already said by fgrieu in his answer, this is possible.
There are multiple ways to protect deterministic ECDSA against fault attacks, but these ways will depend on your fault model.
If you consider ...
- 7,163
16
votes
Accepted
What curve and key length to use in ECDSA?
SafeCurves lists some ways to compare the security of elliptic curves. Their security criteria are split to "ECDLP security" and "ECC security". Failing the former basically means "there is no way to ...
- 31.2k
16
votes
How do RSA and ECDSA differ in signing performance?
ECDSA should in general create signatures faster than RSA for the same cryptographic strength if you just look at the mathematics. In the end the modular exponentiation is performed for smaller ...
- 84.5k
16
votes
Accepted
Difference between X25519 vs. Ed25519
Is X25519 and Ed25519 the same curve?
No. X25519 isn't a curve, it's an Elliptic-Curve Diffie-Hellman (ECDH) protocol using the x coordinate of the curve ...
- 4,935
15
votes
Accepted
Why ECDSA has its form?
The main reason is historical (and a bit sad).
ECDSA can be seen as a repurposed authentication mechanism. The private key owner wants to prove knowledge of the private key $x$ that matches a given ...
- 84.5k
14
votes
Digital signature that is only verifiable by one specific person
Lets say Alice wants to send Bob a sensitive message, she wants to prove to Bob that it came from her, but she doesn't want Bob to be able to prove that to anyone else.
A MAC is a good way of doing ...
- 162
13
votes
Accepted
Is there any reason to use RSA or DSA when we have ECC?
There are three use cases where RSA beats common ECC algorithms, such as ECDSA:
Signature with verification frequent or/and by low-power devices or/and where the verification code needs to be small. ...
- 122k
13
votes
Accepted
When would I need DSA as opposed to RSA for digital signature?
The digital signature algorithm encrypts a hash using the senders private key and the receiver's public key.
Huh? I see two problems with the above statement;
"Encryption"; using the word ...
- 131k
13
votes
Accepted
Are DSA and ECDSA provably secure assuming DL security?
(The (EC)DSA algorithm involves two functions: (i) the "conversion function" $f$, which for the case of DSA is a modulo $q$ operation and for ECDSA is the modulo $q$ operation applied to the $x$-...
- 4,463
12
votes
Accepted
Reasons for Chinese SM2 Digital Signature Algorithm
The SM2 digital signature algorithm. Fix a curve $E/k$ over a field $\mathbb F_p$. Fix a standard base point $G$ of prime order $n$ on $E/\mathbb F_p$. Fix a hash function $H\colon \{0,1\}^* \to \...
- 45.6k
12
votes
Accepted
Does the size of a ECDSA key determine the hash algorithm?
No, in general the hash isn't determined by the curve definition by NIST. Reasonable mappings of course exist (for a 224 bit curve you would probably use a hash with output size of 224 such as SHA-224)...
- 84.5k
12
votes
Accepted
RFC 6979 - Why not simply hash the message & the private key for deterministic ECDSA?
Deterministic signatures are safe in the random oracle model. Using HMAC_DRBG allowed me to rely on existing research on the safety of that construction and how close it comes to a "true" ...
- 84.5k
12
votes
Accepted
11
votes
How does recovering the public key from an ECDSA signature work?
As @poncho says, both keys $Q_1=r^{-1}(sR-zG)$ and $Q_2=r^{-1}(sR'-zG)$ will validate the given signature, i.e., $(s^{-1}zG+s^{-1}rQ_i)_x=r\mod{n}$. For some curves, with small but non-zero ...
- 211
11
votes
Accepted
How can a non-crypto-expert implement crypto libraries in a programming language?
The best option is to avoid doing so as much as possible. Ideally, your language of choice will offer a wrapper around a battle tested library such as libsodium (or maybe bearssl one day).
...
- 19.2k
11
votes
Which hash is used when providing signature algorithm ED25519 or ED448?
Hash algorithms:
Ed25519 uses SHA-512 (As referenced on wikipedia or on bearssl.org)
Ed448 uses SHAKE-256$^1$ (As referenced on bearssl.org)
$^1$ SHAKE-256 is a SHA-3 algorithm, a subgroup of the "...
- 6,316
10
votes
Accepted
Should different key pairs be used for signing and encryption?
Yes.
Modern cryptosystems are designed and analysed under the assumption that the key is never used for anything else. If you use your encryption keys for digital signatures, you are violating that ...
- 4,382
10
votes
Accepted
Creating a license system based on asymmetric encryption (RSA or ECDSA)
Sign the license text. There's nothing confidential in the license text, so you don't need confidentiality.
If possible, include some kind of customer ID or something in the license that links it to ...
- 35.3k
10
votes
Accepted
Can Alice send Bob a secure message with only DSA and no key exchange?
Let me first answer your actual question (and then I'll proceed to answer something slightly different that I think will be informative and helpful). Your question asks whether it's possible to use ...
- 26.9k
Only top scored, non community-wiki answers of a minimum length are eligible