# Tag Info

3

What would be a good choice for the hash type? Whatever works best for you. As long as the hash is considered secure, the difference comes down to performance. SHA-256 and SHA-512 are both traditional and safe choices recommended e.g. by NIST. You can't really go wrong with either of those. Which one is faster depends on your hardware. (SHA-384 is ...

1

Unless the key derivation function you use is specifically designed to exploit related-key attacks, then no, it will not result in a vulnerable related-key pair. It is true that XSalsa20 is not designed with related-key attack resistance in mind, but a key put through any decent KDF will not lead to exploitable weakness. This answer explains the kind of ...

2

My solution is based on Pedersen commitments; in this scheme, we work in a prime-sized ($p$) subfield of some group, perhaps $\mathbb{Z}_{kp+1}$, so some prime $kp+1$; where both $p$ and $kp+1$ are large enough to make the discrete log problem intractible. We have two generators of this subgroup $g$ and $h$, and it is important that no one knows the ...

0

This is a kind of blind signatures. Most of the context of blind signatures are unsecure, but there are few interesting use cases. For you case, Alice can just hash the random server challenge before signing and the server hashes as well the challenge during verification/authentication.

Top 50 recent answers are included