41
votes
Accepted
HMAC vs ECDSA for JWT
The distinction is that ECDSA solves a problem that HMAC does not. If you need that problem solved, then you need to do ECDSA rather than HMAC; if you do not, then HMAC works just as well (and is a ...
- 138k
41
votes
Accepted
ECDSA, EdDSA and ed25519 relationship / compatibility
Ed25519 is a specific instance of the EdDSA family of signature schemes. Ed25519 is specified in RFC 8032 and widely used. The only other instance of EdDSA that anyone cares about is Ed448, which is ...
- 46.8k
39
votes
Accepted
Should I use RSA encryption since RSA is said to be broken by NSA?
This question has many problems in the way it was asked, and clearly did not come after doing some investigation. However, since this seems to be a misconception that is spreading widely, I will ...
- 27.2k
34
votes
Digital signature that is only verifiable by one specific person
What you seem to be looking for is deniable authentication.
This is actually a somewhat stronger property than what you're asking for: it guarantees that the recipient (let's call him Bob) cannot ...
- 45.2k
28
votes
Accepted
Curve25519 over Ed25519 for key exchange? Why?
There's a few different related parts here, and the nomenclature of the library you've cited is a little confusing.
Curve25519 is an elliptic curve over the finite field $\mathbb F_p$, where $p = 2^{...
- 46.8k
22
votes
Accepted
What is the intuition for ECDSA?
It is possible to view DSA/ECDSA as an identification scheme (like Schnorr) but with a different variant of Fiat-Shamir. This gives the intuition that you are perhaps looking for. I will include an ...
- 27.2k
22
votes
ECDSA Signature R|S to ASN1 DER Encoding question
The ASN.1 DER format is deterministic; i.e. there is only a single sequence of bytes that validly encodes given $r$ and $s$ values. Mind the details, though: the encodings of $r$ and $s$ are minimal-...
- 85.7k
21
votes
Accepted
What is the difference between ECDSA and EdDSA?
Partially covered by does TLS 1.3 use ECDSA-Sig-Value encoded signatures for Ed25519 / Ed448? but to add a little, rfc8032 describes EdDSA's advantages as:
EdDSA provides high performance on a ...
- 5,815
19
votes
HMAC vs ECDSA for JWT
To add to poncho's answer (since they beat me to it!), there are several advantages to choosing HMAC over ECDSA (or RSA) if you can get away with it:
Insanely better performance: signing and ...
- 2,734
19
votes
Accepted
Difference between X25519 vs. Ed25519
Is X25519 and Ed25519 the same curve?
No. X25519 isn't a curve, it's an Elliptic-Curve Diffie-Hellman (ECDH) protocol using the x coordinate of the curve Curve25519. Ed25519 is an Edwards Digital ...
- 5,351
17
votes
Can deterministic ECDSA be protected against fault attacks?
As already said by fgrieu in his answer, this is possible.
There are multiple ways to protect deterministic ECDSA against fault attacks, but these ways will depend on your fault model.
If you consider ...
- 7,429
15
votes
Accepted
Why ECDSA has its form?
The main reason is historical (and a bit sad).
ECDSA can be seen as a repurposed authentication mechanism. The private key owner wants to prove knowledge of the private key $x$ that matches a given ...
- 85.7k
14
votes
Accepted
Is there any reason to use RSA or DSA when we have ECC?
There are three use cases where RSA beats common ECC algorithms, such as ECDSA:
Signature with verification frequent or/and by low-power devices or/and where the verification code needs to be small. ...
- 131k
14
votes
Digital signature that is only verifiable by one specific person
Lets say Alice wants to send Bob a sensitive message, she wants to prove to Bob that it came from her, but she doesn't want Bob to be able to prove that to anyone else.
A MAC is a good way of doing ...
- 162
13
votes
Accepted
When would I need DSA as opposed to RSA for digital signature?
The digital signature algorithm encrypts a hash using the senders private key and the receiver's public key.
Huh? I see two problems with the above statement;
"Encryption"; using the word ...
- 138k
13
votes
Accepted
13
votes
Accepted
Are DSA and ECDSA provably secure assuming DL security?
(The (EC)DSA algorithm involves two functions: (i) the "conversion function" $f$, which for the case of DSA is a modulo $q$ operation and for ECDSA is the modulo $q$ operation applied to the $x$-...
- 4,873
12
votes
Accepted
RFC 6979 - Why not simply hash the message & the private key for deterministic ECDSA?
Deterministic signatures are safe in the random oracle model. Using HMAC_DRBG allowed me to rely on existing research on the safety of that construction and how close it comes to a "true" ...
- 85.7k
12
votes
Accepted
Reasons for Chinese SM2 Digital Signature Algorithm
The SM2 digital signature algorithm. Fix a curve $E/k$ over a field $\mathbb F_p$. Fix a standard base point $G$ of prime order $n$ on $E/\mathbb F_p$. Fix a hash function $H\colon \{0,1\}^* \to \...
- 46.8k
11
votes
Accepted
How can a non-crypto-expert implement crypto libraries in a programming language?
The best option is to avoid doing so as much as possible. Ideally, your language of choice will offer a wrapper around a battle tested library such as libsodium (or maybe bearssl one day).
...
- 19.4k
11
votes
Which hash is used when providing signature algorithm ED25519 or ED448?
Hash algorithms:
Ed25519 uses SHA-512 (As referenced on wikipedia or on bearssl.org)
Ed448 uses SHAKE-256$^1$ (As referenced on bearssl.org)
$^1$ SHAKE-256 is a SHA-3 algorithm, a subgroup of the "...
- 6,366
10
votes
Accepted
Can Alice send Bob a secure message with only DSA and no key exchange?
Let me first answer your actual question (and then I'll proceed to answer something slightly different that I think will be informative and helpful). Your question asks whether it's possible to use ...
- 27.2k
10
votes
ECDSA key recovery - floating point values
This is not correct, the private key $d_A$ must always be an integer. Your mistake is that you are doing modular division e.g. $\frac{a}{b} \text{ mod } n$ incorrectly. You cannot simply divide the ...
- 3,982
10
votes
Accepted
Elliptic Curve Cryptography - When to use p and when to use n
A possible analogy is two layers in a communication protocol, with $p$ and $n$ the maximum packet payload for the lower and upper layer. They need not be equal (in communication protocols, typically ...
- 131k
10
votes
Can deterministic ECDSA be protected against fault attacks?
Yes, ECDSA (including deterministic) can be protected against fault attacks. An idea is to check any computed signature (by the verifier's algorithm) before releasing the signature (and not releasing ...
- 131k
10
votes
Accepted
Which hash is used when providing signature algorithm ED25519 or ED448?
If you follow the references in RFC 8446, you'll see that it cites RFC 8032 for the definition of the EdDSA-based algorithms.
RFC 8032 in turn tells you all the details about the hash functions and ...
- 46.8k
10
votes
Accepted
Understanding example of ECDSA P256
ECDSA is specified in SEC1. It's instantiation with curve P-256 is specified in FIPS 186-4 (or equivalently in SEC2 under the name secp256r1), and tells that ...
- 131k
9
votes
What is the relation between x y and r s in an ECDSA signature?
Yes, those encoded values are $r$ and $s$.
The ASN.1 integers are signed big endian values while the two fixed sized values are unsigned big endian. So the value field may be identical or it may not, ...
- 88.6k
9
votes
Accepted
EdDSA (Ed25519) is any random number sufficient for a good private key?
Yes.
In order to understand why, you need to understand how the public key is computed.
The secret key is a scalar. A fixed base point is multiplied by that scalar, and no matter what that scalar ...
- 2,857
Only top scored, non community-wiki answers of a minimum length are eligible