Hot answers tagged

40 votes
Accepted

ECDSA, EdDSA and ed25519 relationship / compatibility

Ed25519 is a specific instance of the EdDSA family of signature schemes. Ed25519 is specified in RFC 8032 and widely used. The only other instance of EdDSA that anyone cares about is Ed448, which is ...
user avatar
39 votes
Accepted

Should I use RSA encryption since RSA is said to be broken by NSA?

This question has many problems in the way it was asked, and clearly did not come after doing some investigation. However, since this seems to be a misconception that is spreading widely, I will ...
user avatar
37 votes
Accepted

How does recovering the public key from an ECDSA signature work?

Actually, it is not possible to uniquely recover the public key from an ECDSA signature $(r,s)$. This remains true even if we also assume you know the curve, the hash function used, and you also have ...
user avatar
  • 131k
37 votes
Accepted

HMAC vs ECDSA for JWT

The distinction is that ECDSA solves a problem that HMAC does not. If you need that problem solved, then you need to do ECDSA rather than HMAC; if you do not, then HMAC works just as well (and is a ...
user avatar
  • 131k
34 votes

Digital signature that is only verifiable by one specific person

What you seem to be looking for is deniable authentication. This is actually a somewhat stronger property than what you're asking for: it guarantees that the recipient (let's call him Bob) cannot ...
user avatar
22 votes
Accepted

Curve25519 over Ed25519 for key exchange? Why?

There's a few different related parts here, and the nomenclature of the library you've cited is a little confusing. Curve25519 is an elliptic curve over the finite field $\mathbb F_p$, where $p = 2^{...
user avatar
21 votes
Accepted

What is the intuition for ECDSA?

It is possible to view DSA/ECDSA as an identification scheme (like Schnorr) but with a different variant of Fiat-Shamir. This gives the intuition that you are perhaps looking for. I will include an ...
user avatar
20 votes

ECDSA Signature R|S to ASN1 DER Encoding question

The ASN.1 DER format is deterministic; i.e. there is only a single sequence of bytes that validly encodes given $r$ and $s$ values. Mind the details, though: the encodings of $r$ and $s$ are minimal-...
user avatar
20 votes
Accepted

What is the difference between ECDSA and EdDSA?

Partially covered by does TLS 1.3 use ECDSA-Sig-Value encoded signatures for Ed25519 / Ed448? but to add a little, rfc8032 describes EdDSA's advantages as: EdDSA provides high performance on a ...
user avatar
18 votes

HMAC vs ECDSA for JWT

To add to poncho's answer (since they beat me to it!), there are several advantages to choosing HMAC over ECDSA (or RSA) if you can get away with it: Insanely better performance: signing and ...
user avatar
  • 2,706
17 votes

Can deterministic ECDSA be protected against fault attacks?

As already said by fgrieu in his answer, this is possible. There are multiple ways to protect deterministic ECDSA against fault attacks, but these ways will depend on your fault model. If you consider ...
user avatar
  • 7,163
16 votes
Accepted

What curve and key length to use in ECDSA?

SafeCurves lists some ways to compare the security of elliptic curves. Their security criteria are split to "ECDLP security" and "ECC security". Failing the former basically means "there is no way to ...
user avatar
  • 31.2k
16 votes

How do RSA and ECDSA differ in signing performance?

ECDSA should in general create signatures faster than RSA for the same cryptographic strength if you just look at the mathematics. In the end the modular exponentiation is performed for smaller ...
user avatar
  • 84.5k
16 votes
Accepted

Difference between X25519 vs. Ed25519

Is X25519 and Ed25519 the same curve? No. X25519 isn't a curve, it's an Elliptic-Curve Diffie-Hellman (ECDH) protocol using the x coordinate of the curve ...
user avatar
15 votes
Accepted

Why ECDSA has its form?

The main reason is historical (and a bit sad). ECDSA can be seen as a repurposed authentication mechanism. The private key owner wants to prove knowledge of the private key $x$ that matches a given ...
user avatar
14 votes

Digital signature that is only verifiable by one specific person

Lets say Alice wants to send Bob a sensitive message, she wants to prove to Bob that it came from her, but she doesn't want Bob to be able to prove that to anyone else. A MAC is a good way of doing ...
user avatar
  • 162
13 votes
Accepted

Is there any reason to use RSA or DSA when we have ECC?

There are three use cases where RSA beats common ECC algorithms, such as ECDSA: Signature with verification frequent or/and by low-power devices or/and where the verification code needs to be small. ...
user avatar
  • 122k
13 votes
Accepted

When would I need DSA as opposed to RSA for digital signature?

The digital signature algorithm encrypts a hash using the senders private key and the receiver's public key. Huh? I see two problems with the above statement; "Encryption"; using the word ...
user avatar
  • 131k
13 votes
Accepted

Are DSA and ECDSA provably secure assuming DL security?

(The (EC)DSA algorithm involves two functions: (i) the "conversion function" $f$, which for the case of DSA is a modulo $q$ operation and for ECDSA is the modulo $q$ operation applied to the $x$-...
user avatar
  • 4,463
12 votes
Accepted

Reasons for Chinese SM2 Digital Signature Algorithm

The SM2 digital signature algorithm. Fix a curve $E/k$ over a field $\mathbb F_p$. Fix a standard base point $G$ of prime order $n$ on $E/\mathbb F_p$. Fix a hash function $H\colon \{0,1\}^* \to \...
user avatar
12 votes
Accepted

Does the size of a ECDSA key determine the hash algorithm?

No, in general the hash isn't determined by the curve definition by NIST. Reasonable mappings of course exist (for a 224 bit curve you would probably use a hash with output size of 224 such as SHA-224)...
user avatar
  • 84.5k
12 votes
Accepted

RFC 6979 - Why not simply hash the message & the private key for deterministic ECDSA?

Deterministic signatures are safe in the random oracle model. Using HMAC_DRBG allowed me to rely on existing research on the safety of that construction and how close it comes to a "true" ...
user avatar
12 votes
Accepted

Are ECDSA keys and RSA keys interchangeable?

From the source code: ...
user avatar
11 votes

How does recovering the public key from an ECDSA signature work?

As @poncho says, both keys $Q_1=r^{-1}(sR-zG)$ and $Q_2=r^{-1}(sR'-zG)$ will validate the given signature, i.e., $(s^{-1}zG+s^{-1}rQ_i)_x=r\mod{n}$. For some curves, with small but non-zero ...
user avatar
11 votes
Accepted

How can a non-crypto-expert implement crypto libraries in a programming language?

The best option is to avoid doing so as much as possible. Ideally, your language of choice will offer a wrapper around a battle tested library such as libsodium (or maybe bearssl one day). ...
user avatar
  • 19.2k
11 votes

Which hash is used when providing signature algorithm ED25519 or ED448?

Hash algorithms: Ed25519 uses SHA-512 (As referenced on wikipedia or on bearssl.org) Ed448 uses SHAKE-256$^1$ (As referenced on bearssl.org) $^1$ SHAKE-256 is a SHA-3 algorithm, a subgroup of the "...
user avatar
  • 6,316
10 votes
Accepted

Should different key pairs be used for signing and encryption?

Yes. Modern cryptosystems are designed and analysed under the assumption that the key is never used for anything else. If you use your encryption keys for digital signatures, you are violating that ...
user avatar
  • 4,382
10 votes
Accepted

Creating a license system based on asymmetric encryption (RSA or ECDSA)

Sign the license text. There's nothing confidential in the license text, so you don't need confidentiality. If possible, include some kind of customer ID or something in the license that links it to ...
user avatar
  • 35.3k
10 votes
Accepted

Can Alice send Bob a secure message with only DSA and no key exchange?

Let me first answer your actual question (and then I'll proceed to answer something slightly different that I think will be informative and helpful). Your question asks whether it's possible to use ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible