5

We want $(r,s)$ same for two different set of $d,k,h$ In ECDSA $r = x_0([k]G) \bmod n$ where $k \in [1,n-1]$ and $x_o$ is the x-coordinate of the scalar multiplication $[k]G$ $s = k^{-1}\cdot (h+r\cdot d)$ where $h$ is the left most bits of $h$ to fit in the group order ( for simplicity we called it $h$ again). Now we want same $(r,s)$ for $d,k,h$ and $d',...


5

The proposed digital signature scheme is not secure! More precisely, it is not existentially unforgeable under an adaptive chosen-message attack. Let's consider the following efficient adversary $\mathcal{A}$: it queries the $\mathsf{Sign}_{sk}(\cdot)$ oracle for the digital signatures on $m_1,m_2$, where $m_2:=m_1+1$. The received signatures are $\sigma_1=...


4

For a given private key $d$, random $k$ and message hash $h$: is it possible that there exists a different set of $d$, $k$ and $h$ which produces the same ECDSA signature using the $\text{secp256k1}$ curve? Yes, and further it's easy to explicitly compute an alternate $(d',k',h')$ that matches all reasonable meanings of "different set of $d$, $k$ and $...


2

We can easily see that the signature must be at least as large as the message. Otherwise, it would be impossible to verify any arbitrary single bit. Signing a message with n bits must necessarily must involve a signature that can validate n unrelated 1 bit message subsets. However, if we assume Bob and Mallory are given copies of the message, there may be ...


2

I had emailed Dr Thomas Pornin the very same question and received his reply. With his permission I cross post his answer as followed From: "Thomas Pornin" ... Date: 2021/04/22 11:38 Q1: Additional data k' is concatenated after bits2octets(H(m)) in HMAC input in step d. May we also need to concatenate k' after bits2octets(H(m)) in HMAC input in ...


2

encrypt with the private key, and decrypt with the public key That statement, and the very name privateEncrypt, is incompatible with standard terminology: "public" means known to all and opposes to "private"; and "encrypt" implies transforming some information $X$ into $Y$ in a way such that if $Y$ becomes public, $X$ does not. ...


2

It is totally possible and fairly easy to see without any advanced maths. The curve has order n (n Points in the curve) the private key d is [0... n-1] and the random number k [1... n-1] and there are 2^256 possible values for h. So there are n*(n-1)*2^256 possible inputs (d, k, h combinations). The output is r, s. Where r is there x part of a point so there ...


1

I'm still piecing things together, so bear with me as this may be revised. Access to a signature oracle is either a zero-knowledge resource or breaks the random oracle model for $H_k$. To see this we observe that anyone can generate valid $(m,s)$ pairs for random values of $H_k$. They do this by picking arbitrary $s$ in the required range, squaring to get a ...


1

The XMSS tree is constructed using the W-OTS keys. Each leaf of the XMSS tree corresponds to a distinct W-OTS key. The W-OTS keys have length $ln$, but each node of the XMSS tree should have length $n$. In order to make the size of the W-OTS keys compatible with the XMSS tree, the L-tree is used to first reduce the W-OTS key from $ln$ to $n$ bits.The L-tree ...


Only top voted, non community-wiki answers of a minimum length are eligible