# Tag Info

Accepted

### Why is SHA3 more secure than SHA2?

TL;DR: the assertion "SHA3 is more secure than SHA2" is unproven when we consider collision resistance, or preimage resistance. Addition: there are reasons to prefer SHA3, including being a ...
• 126k

### Why is SHA3 more secure than SHA2?

This is more of an addendum to fgrieu's answer than an answer in itself, but 3 things stand out that COULD make SHA3 more secure than SHA2 from a design standpoint. The first and most obvious is the ...
• 12.7k
Accepted

This table—of Ed25519 vs. the lattice-based post-quantum candidate Dilithium vs. SPHINCS+ variants at a comparable post-quantum security level, with a tradeoff between signature size and signing time—...
• 46.1k

### Why don't crypto-currencies use the Lamport signature scheme?

The major issue will be size difference. The size of ECDSA in bitcoin is much less than the Lamport Signature. For ECDSA in bitcoin The public key is only 33 Bytes (1 byte for prefix, and 32 bytes ...
• 2,008
Accepted

### Understanding example of ECDSA P256

ECDSA is specified in SEC1. It's instantiation with curve P-256 is specified in FIPS 186-4 (or equivalently in SEC2 under the name secp256r1), and tells that ...
• 126k

### Why is SHA3 more secure than SHA2?

I know you already mentioned length extension attacks in your question, but I don't think the importance of that can be overstated in how SHA3 is practically more secure than SHA2 - especially ...

As for the "foot-gun" issues with stateful hash-based signatures, it comes down to repeating state. Stateful hash-based signatures (XMSS, LMS) are moderately interesting (can be implemented with ...
• 134k
Accepted

### Small Quantum Signatures - Reality check needed

I see two problems with this idea. The first problem is Shor's algorithm; that's a quantum algorithm that is able to find the cycle length of a group (and if you can solve that problem, it is easy to ...
• 134k

### Stateless hash based public key cryptography?

Yes, a stateless hashbased signature method called Sphincs was recently proposed. It works by having a moderately large Merkle tree (similar to what D.W. suggested), but instead of using Lamport or ...
• 134k
Accepted

### Difference Between Gravity-SPHINCS and SPHINCS+?

Gravity-SPHINCS and SPHINCS+ are two different improvements of the original SPHINCS algorithm. Both change the few-time signature scheme HORST (used in SPHINCS) in slightly different ways. However, ...
• 2,870
Accepted

### Does still make sense to use SHA1?

No, use SHA256. If you look at https://bench.cr.yp.to/results-hash.html it seems that SHA256 would probably be the better choice concerning speed as well. Therefore I don't see a good reason to go ...
• 4,721
Accepted

### How can I generate reasonably short temporary unlock codes?

Use hash based cryptography. First, define a one way function F. It takes as input a small (10-16 byte) string and uses a secure hash function (EG:SHA2) to produce ...
Accepted

### Winternitz One time signature security

W-OTS+ is stronger, as it makes weaker assumptions on the hash function. Let us take a rather extreme example, let us consider W-OTS and W-OTS+ based on the MD5 hash function. Now, the proof for W-...
• 134k

### How to use SPHINCS+?

Most of this was already explained in the comments but let me summarize this. a) SPHINCS+ as SPHINCS are stateless signature schemes like RSA or (EC)DSA. You can use the secret key to sign a ...
• 2,870
Accepted

### SPHINCS and HORST: can we sign the same message twice?

So as I understand, given the fact that the random bit masks are constant after instantiation of the scheme, SPHINCS is a deterministic scheme. Actually, Sphincs as originally proposed is ...
• 134k
Accepted

• 12k