45
votes
Accepted
HMAC vs ECDSA for JWT
The distinction is that ECDSA solves a problem that HMAC does not. If you need that problem solved, then you need to do ECDSA rather than HMAC; if you do not, then HMAC works just as well (and is a ...
- 145k
43
votes
Accepted
ECDSA, EdDSA and ed25519 relationship / compatibility
Ed25519 is a specific instance of the EdDSA family of signature schemes. Ed25519 is specified in RFC 8032 and widely used. The only other instance of EdDSA that anyone cares about is Ed448, which is ...
- 47.9k
39
votes
Accepted
Should I use RSA encryption since RSA is said to be broken by NSA?
This question has many problems in the way it was asked, and clearly did not come after doing some investigation. However, since this seems to be a misconception that is spreading widely, I will ...
- 27.6k
34
votes
Accepted
Curve25519 over Ed25519 for key exchange? Why?
There's a few different related parts here, and the nomenclature of the library you've cited is a little confusing.
Curve25519 is an elliptic curve over the finite field $\mathbb F_p$, where $p = 2^{...
- 47.9k
34
votes
Digital signature that is only verifiable by one specific person
What you seem to be looking for is deniable authentication.
This is actually a somewhat stronger property than what you're asking for: it guarantees that the recipient (let's call him Bob) cannot ...
- 45.9k
26
votes
Accepted
What is the difference between ECDSA and EdDSA?
Partially covered by does TLS 1.3 use ECDSA-Sig-Value encoded signatures for Ed25519 / Ed448? but to add a little, rfc8032 describes EdDSA's advantages as:
EdDSA provides high performance on a ...
- 6,289
24
votes
Accepted
What is the intuition for ECDSA?
It is possible to view DSA/ECDSA as an identification scheme (like Schnorr) but with a different variant of Fiat-Shamir. This gives the intuition that you are perhaps looking for. I will include an ...
- 27.6k
24
votes
ECDSA Signature R|S to ASN1 DER Encoding question
The ASN.1 DER format is deterministic; i.e. there is only a single sequence of bytes that validly encodes given $r$ and $s$ values. Mind the details, though: the encodings of $r$ and $s$ are minimal-...
- 86.6k
24
votes
Accepted
Difference between X25519 vs. Ed25519
Is X25519 and Ed25519 the same curve?
No. X25519 isn't a curve, it's an Elliptic-Curve Diffie-Hellman (ECDH) protocol using the x coordinate of the curve Curve25519. Ed25519 is an Edwards Digital ...
- 5,786
20
votes
HMAC vs ECDSA for JWT
To add to poncho's answer (since they beat me to it!), there are several advantages to choosing HMAC over ECDSA (or RSA) if you can get away with it:
Insanely better performance: signing and ...
- 2,814
17
votes
Can deterministic ECDSA be protected against fault attacks?
As already said by fgrieu in his answer, this is possible.
There are multiple ways to protect deterministic ECDSA against fault attacks, but these ways will depend on your fault model.
If you consider ...
- 7,629
17
votes
Accepted
Why ECDSA has its form?
The main reason is historical (and a bit sad).
ECDSA can be seen as a repurposed authentication mechanism. The private key owner wants to prove knowledge of the private key $x$ that matches a given ...
- 86.6k
15
votes
Accepted
Is there any reason to use RSA or DSA when we have ECC?
There are three use cases where RSA beats common ECC algorithms, such as ECDSA:
Signature with verification frequent or/and by low-power devices or/and where the verification code needs to be small. ...
- 138k
14
votes
Digital signature that is only verifiable by one specific person
Lets say Alice wants to send Bob a sensitive message, she wants to prove to Bob that it came from her, but she doesn't want Bob to be able to prove that to anyone else.
A MAC is a good way of doing ...
- 162
13
votes
Accepted
When would I need DSA as opposed to RSA for digital signature?
The digital signature algorithm encrypts a hash using the senders private key and the receiver's public key.
Huh? I see two problems with the above statement;
"Encryption"; using the word ...
- 145k
13
votes
Accepted
13
votes
Accepted
Are DSA and ECDSA provably secure assuming DL security?
(The (EC)DSA algorithm involves two functions: (i) the "conversion function" $f$, which for the case of DSA is a modulo $q$ operation and for ECDSA is the modulo $q$ operation applied to the $x$-...
- 5,133
12
votes
Accepted
Reasons for Chinese SM2 Digital Signature Algorithm
The SM2 digital signature algorithm. Fix a curve $E/k$ over a field $\mathbb F_p$. Fix a standard base point $G$ of prime order $n$ on $E/\mathbb F_p$. Fix a hash function $H\colon \{0,1\}^* \to \...
- 47.9k
12
votes
Which hash is used when providing signature algorithm ED25519 or ED448?
Hash algorithms:
Ed25519 uses SHA-512 (As referenced on wikipedia or on bearssl.org)
Ed448 uses SHAKE-256$^1$ (As referenced on bearssl.org)
$^1$ SHAKE-256 is a SHA-3 algorithm, a subgroup of the "...
- 6,406
11
votes
Accepted
How can a non-crypto-expert implement crypto libraries in a programming language?
The best option is to avoid doing so as much as possible. Ideally, your language of choice will offer a wrapper around a battle tested library such as libsodium (or maybe bearssl one day).
...
- 19.5k
11
votes
Why OpenSSH prefers ECDSA nistp256 keys over -384 and -521, and those over Ed25519, for host key verification?
If I remember correctly, it is simply an issue of performance. Remember, HostKeyAlgorithms determines the method used to authenticate the server to the client, it ...
- 13k
10
votes
ECDSA key recovery - floating point values
This is not correct, the private key $d_A$ must always be an integer. Your mistake is that you are doing modular division e.g. $\frac{a}{b} \text{ mod } n$ incorrectly. You cannot simply divide the ...
- 4,012
10
votes
Accepted
Elliptic Curve Cryptography - When to use p and when to use n
A possible analogy is two layers in a communication protocol, with $p$ and $n$ the maximum packet payload for the lower and upper layer. They need not be equal (in communication protocols, typically ...
- 138k
10
votes
Can deterministic ECDSA be protected against fault attacks?
Yes, ECDSA (including deterministic) can be protected against fault attacks. An idea is to check any computed signature (by the verifier's algorithm) before releasing the signature (and not releasing ...
- 138k
10
votes
Accepted
What is the recommended minimum key length for ECDSA signature
You are already well on your way if you've found keylength.com. It references the documents that the recommendations are based on, so if you need a more clear reason to go for a specific key size then ...
- 91.7k
10
votes
Accepted
Which hash is used when providing signature algorithm ED25519 or ED448?
If you follow the references in RFC 8446, you'll see that it cites RFC 8032 for the definition of the EdDSA-based algorithms.
RFC 8032 in turn tells you all the details about the hash functions and ...
- 47.9k
10
votes
Accepted
Understanding example of ECDSA P256
ECDSA is specified in SEC1. It's instantiation with curve P-256 is specified in FIPS 186-4 (or equivalently in SEC2 under the name secp256r1), and tells that ...
- 138k
9
votes
Accepted
Is it usual for a signed message to contain the public key of the signer?
I'd say that most of the time the signature is accompanied by the certificate of the signer. This certificate contains the public key. Most container formats such as CMS (used in S/MIME, also known as ...
- 91.7k
9
votes
What is the relation between x y and r s in an ECDSA signature?
Yes, those encoded values are $r$ and $s$.
The ASN.1 integers are signed big endian values while the two fixed sized values are unsigned big endian. So the value field may be identical or it may not, ...
- 91.7k
Only top scored, non community-wiki answers of a minimum length are eligible