7
votes
Accepted
Why do we need additional secret value (k) in ECDSA?
First, why does $k$ need to be secret in ECDSA?
With the question's notation, in ECDSA, $s=k^{-1}(z+q\,r)\bmod n$ where $n$ is the public prime order of the elliptic curve group, $z$ is public since ...
3
votes
The security of using a digital signature scheme twice with randomness
The scheme is insecure; someone can, with two valid signatures, generate a valid signature to a different message.
Suppose we have the signatures:
$(r, \sigma_0, \sigma_1)$ a valid signature for the ...
1
vote
The security of using a digital signature scheme twice with randomness
This is a partial answer. The desired security goal (existential vs strong unforgeability or others?) hasn't been explicitly stated. Without restrictions, we can assume that (any) unforgeability is ...
1
vote
Accepted
Is it safe to derive a Falcon512 key pair from a XOF output?
A KDF usually has stronger security requirements than a XOF. I've sometimes called a hash a "poor man's KDF" - it is probably secure but it hasn't been explicitly designed to be secure as a ...
Only top scored, non community-wiki answers of a minimum length are eligible
Related Tags
signature × 1423rsa × 285
public-key × 257
elliptic-curves × 146
encryption × 144
dsa × 141
hash × 126
post-quantum-cryptography × 73
hash-signature × 60
authentication × 58
certificates × 56
zero-knowledge-proofs × 50
ed25519 × 47
mac × 37
algorithm-design × 36
protocol-design × 36
provable-security × 35
forgery × 35
schnorr-signature × 30
diffie-hellman × 28
cryptocurrency × 28
key-exchange × 26
openssl × 26
attack × 25
elgamal-signature × 25