# Tag Info

2

The video (at least, where the question links) illustrates the Baby-step/Giant-step Discrete Logarithm method in the multiplicative group modulo $p$, for prime $p$. That is the set $\{1,2,\ldots,p-2,p-1\}$, under the internal operation multiplication modulo $p$. This group has essentially nothing to do with an Elliptic Curve group. The principle of Baby-step/...

0

If I've understood correctly, you are talking about the curve order $n = |E(K)|$ and a prime subgroup generated by a point $G$ with order $r = |\langle G\rangle|$. Then we have a cofactor $h = \frac{n}{r}$. Some curves like Curve25519 is doesn't have prime order, since it has cofactor 8. This means that there are other subgroups of $E(K)$ with order $2,4,8,... 4 EdDSA is not ECDSA over a different curve. Rather, it is a type of Schnorr signature. Indeed the name is very confusing, and I'm pretty sure that it was chosen in order to give this impression, since Schnorr is less well known. Schnorr is essentially a zero-knowledge proof of knowledge of the discrete log of the public key, obtained via the Fiat-Shamir ... 1 If the only change you make is removing the hashing step, things certainly fall apart. Using the description from Wikipedia you used in your question, this would mean to replace the first step with$e := m$and then continue with the rest of the steps unchanged. The second step would then define$z$as the$L_n$leftmost bits of$m$. Thus, any messages that ... 2 The truthful answer here is that I don't know. I am pretty sure actually that the better answer is that this is unknown. The assumption that the hash is only required for collision resistance is blatantly false, since typically one needs a random oracle for such schemes. In ECDSA specifically, we don't have actually have proof of security even with a random ... 1 I will first address the issues of the diagram; Encryption part Although the encryption is mentioned as optional there is no mention of how the AES key is generated. The common method is the Diffie-Hellman Key Exchange and the Elliptic Curve version of it is preferred ECDH. there is no mention of the mode of operation. CBC, CTR, GCM,... etc. There is no ... 0 Or will anything go wrong with the scheme I describe above? Is the AES key public? If it is, then it is easy to generate two messages that have the same tag (and hence would act like a collision). If the AES key secret to both the signer and the verifier? If it is, well, why bother with ECDSA at all; if you have a shared secret key, you can use a Message ... 2 Can someone help with an example? Ok, here's a simple example; suppose we precompute a table that contained all the points of the form$(a \cdot 256^b) G$, for$0 < a < 256$and where$b$be within the scalar we intend to support. For example, the table (if we support 2 byte scalars) would contain the points$\text{0x01}G, \text{0x02}G, …,\text{0xff}G,...

2

You're wrong. This is a difference between TLS 1.2 and 1.3. In 1.2 SignatureAndHashAlgorithm identifies only the algorithm (not curve) and hash. In 1.3 SignatureScheme does identify the curve for ECDSA, and the certificate OID for RSA-PSS. See the next to last para on page 44: [1.3] ECDSA signature schemes align with TLS 1.2's ECDSA hash/signature pairs. ...

2

Using the notation there, ECDSA signature generation requires a single Elliptic Curve point multiplication, $k\times G$. Whereas naive signature verification uses two, computing $u_1\times G$ and $u_2\times Q_A$ before adding them. Point multiplication is typically by far the slowest operation in signature generation/verification, beside perhaps the hash (...

5

I was expecting that the signature verification will be faster than the signature generation Because signature verification is faster in RSA? Well, as you can see, RSA != ECDSA; the operations involved in both signing and verification are completely different. what makes the signature generation faster ? Because signature generation involves only one ...

Top 50 recent answers are included