Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs
31 votes
Accepted

Why is SHA3 more secure than SHA2?

TL;DR: the assertion "SHA3 is more secure than SHA2" is unproven when we consider collision resistance, or preimage resistance. Addition: there are reasons to prefer SHA3, including being a ...
fgrieu's user avatar
  • 142k
22 votes

Why is SHA3 more secure than SHA2?

This is more of an addendum to fgrieu's answer than an answer in itself, but 3 things stand out that COULD make SHA3 more secure than SHA2 from a design standpoint. The first and most obvious is the ...
Richie Frame's user avatar
  • 13.1k
19 votes
Accepted

Advantages and disadvantages of hash-based signatures

This table—of Ed25519 vs. the lattice-based post-quantum candidate Dilithium vs. SPHINCS+ variants at a comparable post-quantum security level, with a tradeoff between signature size and signing time—...
Squeamish Ossifrage's user avatar
12 votes
Accepted

Understanding example of ECDSA P256

ECDSA is specified in SEC1. It's instantiation with curve P-256 is specified in FIPS 186-4 (or equivalently in SEC2 under the name secp256r1), and tells that ...
fgrieu's user avatar
  • 142k
10 votes

Why don't crypto-currencies use the Lamport signature scheme?

The major issue will be size difference. The size of ECDSA in bitcoin is much less than the Lamport Signature. For ECDSA in bitcoin The public key is only 33 Bytes (1 byte for prefix, and 32 bytes ...
crypt's user avatar
  • 2,449
10 votes

Advantages and disadvantages of hash-based signatures

As for the "foot-gun" issues with stateful hash-based signatures, it comes down to repeating state. Stateful hash-based signatures (XMSS, LMS) are moderately interesting (can be implemented with ...
poncho's user avatar
  • 148k
10 votes

Why is SHA3 more secure than SHA2?

I know you already mentioned length extension attacks in your question, but I don't think the importance of that can be overstated in how SHA3 is practically more secure than SHA2 - especially ...
R.. GitHub STOP HELPING ICE's user avatar
10 votes
Accepted

Why is SHA256 used as a layer on top of Digital Signature

Well, for one, signature algorithms really don't use "Asynchronous Encryption". What they do is use the private key to generate a signature that has some verifiable relationship (with the ...
poncho's user avatar
  • 148k
7 votes
Accepted

Difference Between Gravity-SPHINCS and SPHINCS+?

Gravity-SPHINCS and SPHINCS+ are two different improvements of the original SPHINCS algorithm. Both change the few-time signature scheme HORST (used in SPHINCS) in slightly different ways. However, ...
mephisto's user avatar
  • 2,908
7 votes
Accepted

Mapping the hash of message to a point of elliptic curve for signature

That's insecure. In BLS signatures: for private key $x$ and public key $X = xP$, the signature is computed as $T = xS$, and the verification checks if $e(T, P) = e(S, X)$, which works because: $e(T, ...
Conrado's user avatar
  • 6,464
7 votes
Accepted

Why are LMS and XMSS not candidates in the Post-Quantum Cryptography Standardization process?

Can anyone explain why? That is because NIST specifically stated that stateful schemes were not allowed in the NIST postquantum competition, because they could not be implemented using the API that ...
poncho's user avatar
  • 148k
6 votes
Accepted

Winternitz One time signature security

W-OTS+ is stronger, as it makes weaker assumptions on the hash function. Let us take a rather extreme example, let us consider W-OTS and W-OTS+ based on the MD5 hash function. Now, the proof for W-...
poncho's user avatar
  • 148k
6 votes

How to use SPHINCS+?

Most of this was already explained in the comments but let me summarize this. a) SPHINCS+ as SPHINCS are stateless signature schemes like RSA or (EC)DSA. You can use the secret key to sign a ...
mephisto's user avatar
  • 2,908
6 votes
Accepted

Does still make sense to use SHA1?

No, use SHA256. If you look at https://bench.cr.yp.to/results-hash.html it seems that SHA256 would probably be the better choice concerning speed as well. Therefore I don't see a good reason to go ...
Elias's user avatar
  • 4,913
6 votes
Accepted

How can I generate reasonably short temporary unlock codes?

Use hash based cryptography. First, define a one way function F. It takes as input a small (10-16 byte) string and uses a secure hash function (EG:SHA2) to produce ...
Richard Thiessen's user avatar
6 votes
Accepted

Why do we need Collision Resistant Hash Function for the Merkle Tree Signature Scheme?

There are few papers like XMSS that try to lower the requirement from collision resistant hash function to second-preimage hash function by introducing bit mask. Actually, that's not why XMSS has the ...
poncho's user avatar
  • 148k
6 votes
Accepted

SPHINCS and HORST: can we sign the same message twice?

So as I understand, given the fact that the random bit masks are constant after instantiation of the scheme, SPHINCS is a deterministic scheme. Actually, Sphincs as originally proposed is ...
poncho's user avatar
  • 148k
6 votes
Accepted

Is NOTS a valid one time signature scheme?

Is it legit? No, and you hit on the reason - the algorithm converts the message into a series of 16 values from 1 to 128, and then signs based only on that. That's a total of 112 bits; actually, it'...
poncho's user avatar
  • 148k
6 votes
Accepted

Is $H(k || m) \oplus k$ secure?

Consider $H$ defined as: SHA-512, with it's output XORed with the first 512 bits of the input message (padded with zeroes for short message). With such $H$, the proposed MAC is insecure. Yet, as far ...
fgrieu's user avatar
  • 142k
5 votes

What is "one-time signature"

Paraphrasing the short summary there: A one-time signature (OTS) scheme is a digital signature scheme that can be used to sign one message per key pair, with no assurance of security if the key pair ...
fgrieu's user avatar
  • 142k
4 votes

Is there a signature scheme which doesn't rely on the difficulty of factoring/dlp which generates short signatures?

There are actually quite a few of these. Interest has been raised on this topic mainly due to the "post-quantum" security of such schemes. Also, Lamport is only a one-time signature, and we want a ...
Yehuda Lindell's user avatar
4 votes

Merkle signature scheme

You could, indeed, form a Merkle tree where each internal node is formed from the hash of 3 (or more) lower level nodes. However, because it hurts signature size (which is the main expense of Merkle ...
poncho's user avatar
  • 148k
4 votes

eXtended Merkle Signature Scheme (XMSS) vs Leighton-Micali Signature (LMS)

They have provable security in different models; XMSS in the concrete model, LMS in the random oracle model LMS is about 3 to 5 times faster than XMSS (assuming that the messages are short) I ...
poncho's user avatar
  • 148k
4 votes
Accepted

How is SPHINCS Hash-based signature "stateless"?

I don't have Goldreich in front of me, however it would appear that he is discussing something rather different from a Merkle tree (at least, as it appears in a hash based signature method). In those ...
poncho's user avatar
  • 148k
4 votes
Accepted

W-OTS+ one-wayness property

Inside the probability brackets, everything on one side of the colon describes the distributions of the variables used to define an event on the other side. In the case you described, the success ...
Shan Chen's user avatar
  • 2,725
4 votes
Accepted

What is the public key and signature sizes for XMSS?

The original XMSS paper (eprint 2011/484) discusses an older version of XMSS, which does use rather larger public keys (and I suspect they got the signature size slightly wrong - they forget the ...
poncho's user avatar
  • 148k
4 votes
Accepted

RSA Signing: SHA512 incompatible with PSS?

Yes, this is expected, if the RSASSA-PSS signing code/test uses salt the width of the hash, which is customary. In that case, a $h$-bit hash (with $h$ multiple of 8) requires an RSA public modulus at ...
fgrieu's user avatar
  • 142k
4 votes

Hash function collision importance

I prefer to think of cryptography as infrastructure. We should strive to develop infrastructure that minimizes the number of usage caveats. It's not cryptography's job to define what are "...
Mikero's user avatar
  • 13.4k
4 votes
Accepted

Questions on "A CERTIFIED DIGITAL SIGNATURE" Pg. 19

Yes, that is correct. No, the value $f^{16}(x)$ should be thought of as computed and published prior to any signatures being generated. Only if the signer has the foresight to compute and publish $f^n(...
Daniel S's user avatar
  • 23.9k
4 votes
Accepted

Zk Proof to Prove that I know the secret x of y = HASH(x)

There are many protocols that can do this. I'm listing a few that do not require computational assumption (like pairing or DH) since I'm more familiar with these. They're based on either MPC in the ...
lamba's user avatar
  • 1,365

Only top scored, non community-wiki answers of a minimum length are eligible