6
Yes, there is an important one; The Non-Reputation;
Non-repudiation refers to a situation where a statement's author cannot successfully dispute its authorship or the validity of an associated contract
The HMAC key is a symmetric key therefore there is no non-repudiation. Both sides can not claim that the other side sends them the message $m$. I.e. They ...
4
Signatures provide one property that MACs don't: non-repudiation. With only a MAC (or an AEAD) any party with the secret key could have sent the message. So Bob could forge a message and claim Alice sent it. With a signature only the party holding the corresponding private key could have created the signature. MACs authenticate the message, not the sender.
...
2
To obtain (62, 4) you just add points $\textbf{but on elliptic curves}$.
This is different from a "regular" addition, since the result must be a point of the curve (or a point said to be at infinity, I'm not explaining I try to keep things simple) .
Addition is defined and to do so either you use the heavy addition formulas (If you have seen groups ...
2
To understand the application, it is useful to contrast this with the use of regular signatures.
Imagine Alice sends a message $m$ to Bob together with a signature $\sigma$ of $m$ under her own public key $\mathsf{pk}_A$. A regular signature scheme now has two important properties:
It's publicly verifiable, i.e., anyone can verify that the $\sigma$ is a ...
1
This paper answers your question most succinctly:
The size of a Winternitz signature is roughly $mn/w$ bits and signing roughly requires $2^wm/w$
hash operations, where $m$ is the bit length of the hash value to be signed, $n$ is the output length of
the hash function used in the scheme, and $w$ is the Winternitz parameter determining the tradeoff between ...
1
Let $m'$ be an arbitrary message. Then, the triple $(m', a', b')$ with:
\begin{align}
a' &= -\mathcal{H}(m') \pmod{p-1} \\
b' &= g^{-\mathcal{H}(m')} \cdot y^{-1} \pmod{p}
\end{align}
is a valid signature on $m'$. Since we forged a signature on an arbitrary message, we've achieved total break for this scheme.
1
As per section 9 of the paper, the encoding used is required for the security of the scheme.
The encoding operation may introduce some randomness, so that
different applications of the encoding operation to the same message
will produce different encoded messages, which has benefits for
provable security. For such an encoding method, both an encoding and
a ...
1
If you need signatures, use the signatures API. Signing key pairs may or may not be ephemeral, this depends on your use case. You'll need some way to determine that a signing keypair belongs to whoever you think it belongs to, this can't be handled by the library alone.
Signing key pairs and key exchange key pairs are different data types (hydro_sign_keypair ...
1
Sorry for the downvotes, some users in the community can be toxic sometimes. Anyway, a digital signatures (decryptable, like in RSA or not like in DSA variants) are something that can only be created using a private key and verified using a public key using some very clever mathematics with decades of scrutiny. Hope this helps.
Only top voted, non community-wiki answers of a minimum length are eligible
