7 votes
Accepted

Why do we need additional secret value (k) in ECDSA?

First, why does $k$ need to be secret in ECDSA? With the question's notation, in ECDSA, $s=k^{-1}(z+q\,r)\bmod n$ where $n$ is the public prime order of the elliptic curve group, $z$ is public since ...
fgrieu's user avatar
  • 138k
3 votes

The security of using a digital signature scheme twice with randomness

The scheme is insecure; someone can, with two valid signatures, generate a valid signature to a different message. Suppose we have the signatures: $(r, \sigma_0, \sigma_1)$ a valid signature for the ...
poncho's user avatar
  • 145k
1 vote

The security of using a digital signature scheme twice with randomness

This is a partial answer. The desired security goal (existential vs strong unforgeability or others?) hasn't been explicitly stated. Without restrictions, we can assume that (any) unforgeability is ...
Marc Ilunga's user avatar
  • 2,868
1 vote
Accepted

Is it safe to derive a Falcon512 key pair from a XOF output?

A KDF usually has stronger security requirements than a XOF. I've sometimes called a hash a "poor man's KDF" - it is probably secure but it hasn't been explicitly designed to be secure as a ...
Maarten Bodewes's user avatar
  • 91.9k

Only top scored, non community-wiki answers of a minimum length are eligible