# Tag Info

Accepted

### ECDSA, EdDSA and ed25519 relationship / compatibility

Ed25519 is a specific instance of the EdDSA family of signature schemes. Ed25519 is specified in RFC 8032 and widely used. The only other instance of EdDSA that anyone cares about is Ed448, which is ...
• 45.6k
Accepted

### Should I use RSA encryption since RSA is said to be broken by NSA?

This question has many problems in the way it was asked, and clearly did not come after doing some investigation. However, since this seems to be a misconception that is spreading widely, I will ...
• 26.9k
Accepted

### How does recovering the public key from an ECDSA signature work?

Actually, it is not possible to uniquely recover the public key from an ECDSA signature $(r,s)$. This remains true even if we also assume you know the curve, the hash function used, and you also have ...
• 131k
Accepted

### HMAC vs ECDSA for JWT

The distinction is that ECDSA solves a problem that HMAC does not. If you need that problem solved, then you need to do ECDSA rather than HMAC; if you do not, then HMAC works just as well (and is a ...
• 131k

### Digital signature that is only verifiable by one specific person

What you seem to be looking for is deniable authentication. This is actually a somewhat stronger property than what you're asking for: it guarantees that the recipient (let's call him Bob) cannot ...
• 44.2k
Accepted

• 45.6k
Accepted

### Does the size of a ECDSA key determine the hash algorithm?

No, in general the hash isn't determined by the curve definition by NIST. Reasonable mappings of course exist (for a 224 bit curve you would probably use a hash with output size of 224 such as SHA-224)...
• 84.5k
Accepted

### RFC 6979 - Why not simply hash the message & the private key for deterministic ECDSA?

Deterministic signatures are safe in the random oracle model. Using HMAC_DRBG allowed me to rely on existing research on the safety of that construction and how close it comes to a "true" ...
• 84.5k
Accepted

### Are ECDSA keys and RSA keys interchangeable?

From the source code: ...
• 84.5k

### How does recovering the public key from an ECDSA signature work?

As @poncho says, both keys $Q_1=r^{-1}(sR-zG)$ and $Q_2=r^{-1}(sR'-zG)$ will validate the given signature, i.e., $(s^{-1}zG+s^{-1}rQ_i)_x=r\mod{n}$. For some curves, with small but non-zero ...
Accepted

### How can a non-crypto-expert implement crypto libraries in a programming language?

The best option is to avoid doing so as much as possible. Ideally, your language of choice will offer a wrapper around a battle tested library such as libsodium (or maybe bearssl one day). ...
• 19.2k

### Which hash is used when providing signature algorithm ED25519 or ED448?

Hash algorithms: Ed25519 uses SHA-512 (As referenced on wikipedia or on bearssl.org) Ed448 uses SHAKE-256$^1$ (As referenced on bearssl.org) $^1$ SHAKE-256 is a SHA-3 algorithm, a subgroup of the "...
• 6,316
Accepted

### Should different key pairs be used for signing and encryption?

Yes. Modern cryptosystems are designed and analysed under the assumption that the key is never used for anything else. If you use your encryption keys for digital signatures, you are violating that ...
• 4,382
Accepted

### Creating a license system based on asymmetric encryption (RSA or ECDSA)

Sign the license text. There's nothing confidential in the license text, so you don't need confidentiality. If possible, include some kind of customer ID or something in the license that links it to ...
• 35.3k