29 votes
Accepted

Why is SHA3 more secure than SHA2?

TL;DR: the assertion "SHA3 is more secure than SHA2" is unproven when we consider collision resistance, or preimage resistance. Addition: there are reasons to prefer SHA3, including being a ...
  • 126k
22 votes

Why is SHA3 more secure than SHA2?

This is more of an addendum to fgrieu's answer than an answer in itself, but 3 things stand out that COULD make SHA3 more secure than SHA2 from a design standpoint. The first and most obvious is the ...
  • 12.7k
18 votes
Accepted

Advantages and disadvantages of hash-based signatures

This table—of Ed25519 vs. the lattice-based post-quantum candidate Dilithium vs. SPHINCS+ variants at a comparable post-quantum security level, with a tradeoff between signature size and signing time—...
11 votes

Why don't crypto-currencies use the Lamport signature scheme?

The major issue will be size difference. The size of ECDSA in bitcoin is much less than the Lamport Signature. For ECDSA in bitcoin The public key is only 33 Bytes (1 byte for prefix, and 32 bytes ...
  • 2,008
10 votes
Accepted

Understanding example of ECDSA P256

ECDSA is specified in SEC1. It's instantiation with curve P-256 is specified in FIPS 186-4 (or equivalently in SEC2 under the name secp256r1), and tells that ...
  • 126k
10 votes

Why is SHA3 more secure than SHA2?

I know you already mentioned length extension attacks in your question, but I don't think the importance of that can be overstated in how SHA3 is practically more secure than SHA2 - especially ...
9 votes

Advantages and disadvantages of hash-based signatures

As for the "foot-gun" issues with stateful hash-based signatures, it comes down to repeating state. Stateful hash-based signatures (XMSS, LMS) are moderately interesting (can be implemented with ...
  • 134k
8 votes
Accepted

Small Quantum Signatures - Reality check needed

I see two problems with this idea. The first problem is Shor's algorithm; that's a quantum algorithm that is able to find the cycle length of a group (and if you can solve that problem, it is easy to ...
  • 134k
8 votes

Stateless hash based public key cryptography?

Yes, a stateless hashbased signature method called Sphincs was recently proposed. It works by having a moderately large Merkle tree (similar to what D.W. suggested), but instead of using Lamport or ...
  • 134k
7 votes
Accepted

Difference Between Gravity-SPHINCS and SPHINCS+?

Gravity-SPHINCS and SPHINCS+ are two different improvements of the original SPHINCS algorithm. Both change the few-time signature scheme HORST (used in SPHINCS) in slightly different ways. However, ...
  • 2,870
6 votes
Accepted

Does still make sense to use SHA1?

No, use SHA256. If you look at https://bench.cr.yp.to/results-hash.html it seems that SHA256 would probably be the better choice concerning speed as well. Therefore I don't see a good reason to go ...
  • 4,721
6 votes
Accepted

How can I generate reasonably short temporary unlock codes?

Use hash based cryptography. First, define a one way function F. It takes as input a small (10-16 byte) string and uses a secure hash function (EG:SHA2) to produce ...
6 votes
Accepted

Winternitz One time signature security

W-OTS+ is stronger, as it makes weaker assumptions on the hash function. Let us take a rather extreme example, let us consider W-OTS and W-OTS+ based on the MD5 hash function. Now, the proof for W-...
  • 134k
6 votes

How to use SPHINCS+?

Most of this was already explained in the comments but let me summarize this. a) SPHINCS+ as SPHINCS are stateless signature schemes like RSA or (EC)DSA. You can use the secret key to sign a ...
  • 2,870
6 votes
Accepted

SPHINCS and HORST: can we sign the same message twice?

So as I understand, given the fact that the random bit masks are constant after instantiation of the scheme, SPHINCS is a deterministic scheme. Actually, Sphincs as originally proposed is ...
  • 134k
6 votes
Accepted

Mapping the hash of message to a point of elliptic curve for signature

That's insecure. In BLS signatures: for private key $x$ and public key $X = xP$, the signature is computed as $T = xS$, and the verification checks if $e(T, P) = e(S, X)$, which works because: $e(T, ...
  • 6,129
6 votes
Accepted

Is NOTS a valid one time signature scheme?

Is it legit? No, and you hit on the reason - the algorithm converts the message into a series of 16 values from 1 to 128, and then signs based only on that. That's a total of 112 bits; actually, it'...
  • 134k
6 votes
Accepted

Is $H(k || m) \oplus k$ secure?

Consider $H$ defined as: SHA-512, with it's output XORed with the first 512 bits of the input message (padded with zeroes for short message). With such $H$, the proposed MAC is insecure. Yet, as far ...
  • 126k
5 votes
Accepted

Why do we need Collision Resistant Hash Function for the Merkle Tree Signature Scheme?

There are few papers like XMSS that try to lower the requirement from collision resistant hash function to second-preimage hash function by introducing bit mask. Actually, that's not why XMSS has the ...
  • 134k
5 votes
Accepted

Why are LMS and XMSS not candidates in the Post-Quantum Cryptography Standardization process?

Can anyone explain why? That is because NIST specifically stated that stateful schemes were not allowed in the NIST postquantum competition, because they could not be implemented using the API that ...
  • 134k
4 votes

One-time digital signatures

There is one such signature scheme designed specifically for cryptocurrencies: https://bitcointalk.org/index.php?topic=1129388.0 It is based on ECDSA and works by committing to $k$ (a number used to ...
  • 173
4 votes

Winternitz One-Time Signature

Though this question is fairly old, there is still no accepted answer. Hence, let me try to clarify this. The W-OTS scheme that your talking about was proposed by Ralph Merkle in his 1979 paper as an ...
  • 131
4 votes

Is there a signature scheme which doesn't rely on the difficulty of factoring/dlp which generates short signatures?

There are actually quite a few of these. Interest has been raised on this topic mainly due to the "post-quantum" security of such schemes. Also, Lamport is only a one-time signature, and we want a ...
4 votes

eXtended Merkle Signature Scheme (XMSS) vs Leighton-Micali Signature (LMS)

They have provable security in different models; XMSS in the concrete model, LMS in the random oracle model LMS is about 3 to 5 times faster than XMSS (assuming that the messages are short) I ...
  • 134k
4 votes
Accepted

W-OTS+ one-wayness property

Inside the probability brackets, everything on one side of the colon describes the distributions of the variables used to define an event on the other side. In the case you described, the success ...
  • 2,645
4 votes
Accepted

RSA Signing: SHA512 incompatible with PSS?

Yes, this is expected, if the RSASSA-PSS signing code/test uses salt the width of the hash, which is customary. In that case, a $h$-bit hash (with $h$ multiple of 8) requires an RSA public modulus at ...
  • 126k
4 votes

Hash function collision importance

I prefer to think of cryptography as infrastructure. We should strive to develop infrastructure that minimizes the number of usage caveats. It's not cryptography's job to define what are "...
  • 10.8k
4 votes
Accepted

Questions on "A CERTIFIED DIGITAL SIGNATURE" Pg. 19

Yes, that is correct. No, the value $f^{16}(x)$ should be thought of as computed and published prior to any signatures being generated. Only if the signer has the foresight to compute and publish $f^n(...
  • 12k
4 votes
Accepted

Zk Proof to Prove that I know the secret x of y = HASH(x)

There are many protocols that can do this. I'm listing a few that do not require computational assumption (like pairing or DH) since I'm more familiar with these. They're based on either MPC in the ...
  • 1,232

Only top scored, non community-wiki answers of a minimum length are eligible