7
votes
Accepted
Why do we need additional secret value (k) in ECDSA?
First, why does $k$ need to be secret in ECDSA?
With the question's notation, in ECDSA, $s=k^{-1}(z+q\,r)\bmod n$ where $n$ is the public prime order of the elliptic curve group, $z$ is public since ...
- 138k
3
votes
The security of using a digital signature scheme twice with randomness
The scheme is insecure; someone can, with two valid signatures, generate a valid signature to a different message.
Suppose we have the signatures:
$(r, \sigma_0, \sigma_1)$ a valid signature for the ...
- 145k
1
vote
The security of using a digital signature scheme twice with randomness
This is a partial answer. The desired security goal (existential vs strong unforgeability or others?) hasn't been explicitly stated. Without restrictions, we can assume that (any) unforgeability is ...
- 2,868
1
vote
Accepted
Is it safe to derive a Falcon512 key pair from a XOF output?
A KDF usually has stronger security requirements than a XOF. I've sometimes called a hash a "poor man's KDF" - it is probably secure but it hasn't been explicitly designed to be secure as a ...
- 91.9k
Only top scored, non community-wiki answers of a minimum length are eligible