31
votes
Accepted
Why is SHA3 more secure than SHA2?
TL;DR: the assertion "SHA3 is more secure than SHA2" is unproven when we consider collision resistance, or preimage resistance.
Addition: there are reasons to prefer SHA3, including being a ...
- 132k
22
votes
Why is SHA3 more secure than SHA2?
This is more of an addendum to fgrieu's answer than an answer in itself, but 3 things stand out that COULD make SHA3 more secure than SHA2 from a design standpoint.
The first and most obvious is the ...
- 12.9k
18
votes
Accepted
Advantages and disadvantages of hash-based signatures
This table—of Ed25519 vs. the lattice-based post-quantum candidate Dilithium vs. SPHINCS+ variants at a comparable post-quantum security level, with a tradeoff between signature size and signing time—...
10
votes
Why don't crypto-currencies use the Lamport signature scheme?
The major issue will be size difference. The size of ECDSA in bitcoin is much less than the Lamport Signature.
For ECDSA in bitcoin
The public key is only 33 Bytes (1 byte for prefix, and 32 bytes ...
- 2,313
10
votes
Accepted
Understanding example of ECDSA P256
ECDSA is specified in SEC1. It's instantiation with curve P-256 is specified in FIPS 186-4 (or equivalently in SEC2 under the name secp256r1), and tells that ...
- 132k
10
votes
Why is SHA3 more secure than SHA2?
I know you already mentioned length extension attacks in your question, but I don't think the importance of that can be overstated in how SHA3 is practically more secure than SHA2 - especially ...
9
votes
Advantages and disadvantages of hash-based signatures
As for the "foot-gun" issues with stateful hash-based signatures, it comes down to repeating state.
Stateful hash-based signatures (XMSS, LMS) are moderately interesting (can be implemented with ...
- 139k
8
votes
Accepted
Small Quantum Signatures - Reality check needed
I see two problems with this idea.
The first problem is Shor's algorithm; that's a quantum algorithm that is able to find the cycle length of a group (and if you can solve that problem, it is easy to ...
- 139k
8
votes
Stateless hash based public key cryptography?
Yes, a stateless hashbased signature method called Sphincs was recently proposed. It works by having a moderately large Merkle tree (similar to what D.W. suggested), but instead of using Lamport or ...
- 139k
7
votes
Accepted
Difference Between Gravity-SPHINCS and SPHINCS+?
Gravity-SPHINCS and SPHINCS+ are two different improvements of the original SPHINCS algorithm. Both change the few-time signature scheme HORST (used in SPHINCS) in slightly different ways. However, ...
- 2,870
6
votes
Accepted
Winternitz One time signature security
W-OTS+ is stronger, as it makes weaker assumptions on the hash function.
Let us take a rather extreme example, let us consider W-OTS and W-OTS+ based on the MD5 hash function.
Now, the proof for W-...
- 139k
6
votes
Accepted
Does still make sense to use SHA1?
No, use SHA256.
If you look at https://bench.cr.yp.to/results-hash.html it seems that SHA256 would probably be the better choice concerning speed as well. Therefore I don't see a good reason to go ...
- 4,883
6
votes
Accepted
How can I generate reasonably short temporary unlock codes?
Use hash based cryptography.
First, define a one way function F. It takes as input a small (10-16 byte) string and uses a secure hash function (EG:SHA2) to produce ...
- 806
6
votes
How to use SPHINCS+?
Most of this was already explained in the comments but let me summarize this.
a) SPHINCS+ as SPHINCS are stateless signature schemes like RSA or (EC)DSA. You can use the secret key to sign a ...
- 2,870
6
votes
Accepted
SPHINCS and HORST: can we sign the same message twice?
So as I understand, given the fact that the random bit masks are constant after instantiation of the scheme, SPHINCS is a deterministic scheme.
Actually, Sphincs as originally proposed is ...
- 139k
6
votes
Accepted
Mapping the hash of message to a point of elliptic curve for signature
That's insecure.
In BLS signatures: for private key $x$ and public key $X = xP$, the signature is computed as $T = xS$, and the verification checks if $e(T, P) = e(S, X)$, which works because:
$e(T, ...
- 6,239
6
votes
Accepted
Is NOTS a valid one time signature scheme?
Is it legit?
No, and you hit on the reason - the algorithm converts the message into a series of 16 values from 1 to 128, and then signs based only on that. That's a total of 112 bits; actually, it'...
- 139k
6
votes
Accepted
Is $H(k || m) \oplus k$ secure?
Consider $H$ defined as: SHA-512, with it's output XORed with the first 512 bits of the input message (padded with zeroes for short message). With such $H$, the proposed MAC is insecure. Yet, as far ...
- 132k
5
votes
Accepted
Why do we need Collision Resistant Hash Function for the Merkle Tree Signature Scheme?
There are few papers like XMSS that try to lower the requirement from collision resistant hash function to second-preimage hash function by introducing bit mask.
Actually, that's not why XMSS has the ...
- 139k
5
votes
Accepted
Why are LMS and XMSS not candidates in the Post-Quantum Cryptography Standardization process?
Can anyone explain why?
That is because NIST specifically stated that stateful schemes were not allowed in the NIST postquantum competition, because they could not be implemented using the API that ...
- 139k
5
votes
What is "one-time signature"
Paraphrasing the short summary there: A one-time signature (OTS) scheme is a digital signature scheme that can be used to sign one message per key pair, with no assurance of security if the key pair ...
- 132k
4
votes
One-time digital signatures
There is one such signature scheme designed specifically for cryptocurrencies:
https://bitcointalk.org/index.php?topic=1129388.0
It is based on ECDSA and works by committing to $k$ (a number used to ...
- 173
4
votes
Winternitz One-Time Signature
Though this question is fairly old, there is still no accepted answer. Hence, let me try to clarify this.
The W-OTS scheme that your talking about was proposed by Ralph Merkle in his 1979 paper as an ...
- 131
4
votes
Merkle signature scheme
You could, indeed, form a Merkle tree where each internal node is formed from the hash of 3 (or more) lower level nodes. However, because it hurts signature size (which is the main expense of Merkle ...
- 139k
4
votes
Is there a signature scheme which doesn't rely on the difficulty of factoring/dlp which generates short signatures?
There are actually quite a few of these. Interest has been raised on this topic mainly due to the "post-quantum" security of such schemes. Also, Lamport is only a one-time signature, and we want a ...
- 27.3k
4
votes
eXtended Merkle Signature Scheme (XMSS) vs Leighton-Micali Signature (LMS)
They have provable security in different models; XMSS in the concrete model, LMS in the random oracle model
LMS is about 3 to 5 times faster than XMSS (assuming that the messages are short)
I ...
- 139k
4
votes
Accepted
W-OTS+ one-wayness property
Inside the probability brackets, everything on one side of the colon describes the distributions of the variables used to define an event on the other side. In the case you described, the success ...
- 2,675
4
votes
Accepted
RSA Signing: SHA512 incompatible with PSS?
Yes, this is expected, if the RSASSA-PSS signing code/test uses salt the width of the hash, which is customary. In that case, a $h$-bit hash (with $h$ multiple of 8) requires an RSA public modulus at ...
- 132k
4
votes
Hash function collision importance
I prefer to think of cryptography as infrastructure. We should strive to develop infrastructure that minimizes the number of usage caveats. It's not cryptography's job to define what are "...
- 11.2k
Only top scored, non community-wiki answers of a minimum length are eligible