Hot answers tagged

45 votes
Accepted

HMAC vs ECDSA for JWT

The distinction is that ECDSA solves a problem that HMAC does not. If you need that problem solved, then you need to do ECDSA rather than HMAC; if you do not, then HMAC works just as well (and is a ...
poncho's user avatar
  • 145k
43 votes
Accepted

ECDSA, EdDSA and ed25519 relationship / compatibility

Ed25519 is a specific instance of the EdDSA family of signature schemes. Ed25519 is specified in RFC 8032 and widely used. The only other instance of EdDSA that anyone cares about is Ed448, which is ...
Squeamish Ossifrage's user avatar
39 votes
Accepted

Should I use RSA encryption since RSA is said to be broken by NSA?

This question has many problems in the way it was asked, and clearly did not come after doing some investigation. However, since this seems to be a misconception that is spreading widely, I will ...
Yehuda Lindell's user avatar
34 votes
Accepted

Curve25519 over Ed25519 for key exchange? Why?

There's a few different related parts here, and the nomenclature of the library you've cited is a little confusing. Curve25519 is an elliptic curve over the finite field $\mathbb F_p$, where $p = 2^{...
Squeamish Ossifrage's user avatar
34 votes

Digital signature that is only verifiable by one specific person

What you seem to be looking for is deniable authentication. This is actually a somewhat stronger property than what you're asking for: it guarantees that the recipient (let's call him Bob) cannot ...
Ilmari Karonen's user avatar
26 votes
Accepted

What is the difference between ECDSA and EdDSA?

Partially covered by does TLS 1.3 use ECDSA-Sig-Value encoded signatures for Ed25519 / Ed448? but to add a little, rfc8032 describes EdDSA's advantages as: EdDSA provides high performance on a ...
dave_thompson_085's user avatar
24 votes
Accepted

What is the intuition for ECDSA?

It is possible to view DSA/ECDSA as an identification scheme (like Schnorr) but with a different variant of Fiat-Shamir. This gives the intuition that you are perhaps looking for. I will include an ...
Yehuda Lindell's user avatar
24 votes

ECDSA Signature R|S to ASN1 DER Encoding question

The ASN.1 DER format is deterministic; i.e. there is only a single sequence of bytes that validly encodes given $r$ and $s$ values. Mind the details, though: the encodings of $r$ and $s$ are minimal-...
Thomas Pornin's user avatar
24 votes
Accepted

Difference between X25519 vs. Ed25519

Is X25519 and Ed25519 the same curve? No. X25519 isn't a curve, it's an Elliptic-Curve Diffie-Hellman (ECDH) protocol using the x coordinate of the curve Curve25519. Ed25519 is an Edwards Digital ...
SAI Peregrinus's user avatar
20 votes

HMAC vs ECDSA for JWT

To add to poncho's answer (since they beat me to it!), there are several advantages to choosing HMAC over ECDSA (or RSA) if you can get away with it: Insanely better performance: signing and ...
Tim McLean's user avatar
  • 2,814
17 votes

Can deterministic ECDSA be protected against fault attacks?

As already said by fgrieu in his answer, this is possible. There are multiple ways to protect deterministic ECDSA against fault attacks, but these ways will depend on your fault model. If you consider ...
Lery's user avatar
  • 7,629
17 votes
Accepted

Why ECDSA has its form?

The main reason is historical (and a bit sad). ECDSA can be seen as a repurposed authentication mechanism. The private key owner wants to prove knowledge of the private key $x$ that matches a given ...
Thomas Pornin's user avatar
15 votes
Accepted

Is there any reason to use RSA or DSA when we have ECC?

There are three use cases where RSA beats common ECC algorithms, such as ECDSA: Signature with verification frequent or/and by low-power devices or/and where the verification code needs to be small. ...
fgrieu's user avatar
  • 138k
14 votes

Digital signature that is only verifiable by one specific person

Lets say Alice wants to send Bob a sensitive message, she wants to prove to Bob that it came from her, but she doesn't want Bob to be able to prove that to anyone else. A MAC is a good way of doing ...
JvH's user avatar
  • 162
13 votes
Accepted

When would I need DSA as opposed to RSA for digital signature?

The digital signature algorithm encrypts a hash using the senders private key and the receiver's public key. Huh? I see two problems with the above statement; "Encryption"; using the word ...
poncho's user avatar
  • 145k
13 votes
Accepted

Are ECDSA keys and RSA keys interchangeable?

From the source code: ...
Thomas Pornin's user avatar
13 votes
Accepted

Are DSA and ECDSA provably secure assuming DL security?

(The (EC)DSA algorithm involves two functions: (i) the "conversion function" $f$, which for the case of DSA is a modulo $q$ operation and for ECDSA is the modulo $q$ operation applied to the $x$-...
ckamath's user avatar
  • 5,133
12 votes
Accepted

Reasons for Chinese SM2 Digital Signature Algorithm

The SM2 digital signature algorithm. Fix a curve $E/k$ over a field $\mathbb F_p$. Fix a standard base point $G$ of prime order $n$ on $E/\mathbb F_p$. Fix a hash function $H\colon \{0,1\}^* \to \...
Squeamish Ossifrage's user avatar
12 votes

Which hash is used when providing signature algorithm ED25519 or ED448?

Hash algorithms: Ed25519 uses SHA-512 (As referenced on wikipedia or on bearssl.org) Ed448 uses SHAKE-256$^1$ (As referenced on bearssl.org) $^1$ SHAKE-256 is a SHA-3 algorithm, a subgroup of the "...
AleksanderCH's user avatar
  • 6,406
11 votes
Accepted

How can a non-crypto-expert implement crypto libraries in a programming language?

The best option is to avoid doing so as much as possible. Ideally, your language of choice will offer a wrapper around a battle tested library such as libsodium (or maybe bearssl one day). ...
Ella Rose's user avatar
  • 19.5k
11 votes

Why OpenSSH prefers ECDSA nistp256 keys over -384 and -521, and those over Ed25519, for host key verification?

If I remember correctly, it is simply an issue of performance. Remember, HostKeyAlgorithms determines the method used to authenticate the server to the client, it ...
Richie Frame's user avatar
10 votes

ECDSA key recovery - floating point values

This is not correct, the private key $d_A$ must always be an integer. Your mistake is that you are doing modular division e.g. $\frac{a}{b} \text{ mod } n$ incorrectly. You cannot simply divide the ...
puzzlepalace's user avatar
  • 4,012
10 votes
Accepted

Elliptic Curve Cryptography - When to use p and when to use n

A possible analogy is two layers in a communication protocol, with $p$ and $n$ the maximum packet payload for the lower and upper layer. They need not be equal (in communication protocols, typically ...
fgrieu's user avatar
  • 138k
10 votes

Can deterministic ECDSA be protected against fault attacks?

Yes, ECDSA (including deterministic) can be protected against fault attacks. An idea is to check any computed signature (by the verifier's algorithm) before releasing the signature (and not releasing ...
fgrieu's user avatar
  • 138k
10 votes
Accepted

What is the recommended minimum key length for ECDSA signature

You are already well on your way if you've found keylength.com. It references the documents that the recommendations are based on, so if you need a more clear reason to go for a specific key size then ...
Maarten Bodewes's user avatar
  • 91.7k
10 votes
Accepted

Which hash is used when providing signature algorithm ED25519 or ED448?

If you follow the references in RFC 8446, you'll see that it cites RFC 8032 for the definition of the EdDSA-based algorithms. RFC 8032 in turn tells you all the details about the hash functions and ...
Squeamish Ossifrage's user avatar
10 votes
Accepted

Understanding example of ECDSA P256

ECDSA is specified in SEC1. It's instantiation with curve P-256 is specified in FIPS 186-4 (or equivalently in SEC2 under the name secp256r1), and tells that ...
fgrieu's user avatar
  • 138k
9 votes
Accepted

Is it usual for a signed message to contain the public key of the signer?

I'd say that most of the time the signature is accompanied by the certificate of the signer. This certificate contains the public key. Most container formats such as CMS (used in S/MIME, also known as ...
Maarten Bodewes's user avatar
  • 91.7k
9 votes

What is the relation between x y and r s in an ECDSA signature?

Yes, those encoded values are $r$ and $s$. The ASN.1 integers are signed big endian values while the two fixed sized values are unsigned big endian. So the value field may be identical or it may not, ...
Maarten Bodewes's user avatar
  • 91.7k

Only top scored, non community-wiki answers of a minimum length are eligible