# Tag Info

We want $(r,s)$ same for two different set of $d,k,h$ In ECDSA $r = x_0([k]G) \bmod n$ where $k \in [1,n-1]$ and $x_o$ is the x-coordinate of the scalar multiplication $[k]G$ $s = k^{-1}\cdot (h+r\cdot d)$ where $h$ is the left most bits of $h$ to fit in the group order ( for simplicity we called it $h$ again). Now we want same $(r,s)$ for $d,k,h$ and $d',... 5 The proposed digital signature scheme is not secure! More precisely, it is not existentially unforgeable under an adaptive chosen-message attack. Let's consider the following efficient adversary$\mathcal{A}$: it queries the$\mathsf{Sign}_{sk}(\cdot)$oracle for the digital signatures on$m_1,m_2$, where$m_2:=m_1+1$. The received signatures are$\sigma_1=...
For a given private key $d$, random $k$ and message hash $h$: is it possible that there exists a different set of $d$, $k$ and $h$ which produces the same ECDSA signature using the $\text{secp256k1}$ curve? Yes, and further it's easy to explicitly compute an alternate $(d',k',h')$ that matches all reasonable meanings of "different set of $d$, $k$ and $... 2 We can easily see that the signature must be at least as large as the message. Otherwise, it would be impossible to verify any arbitrary single bit. Signing a message with n bits must necessarily must involve a signature that can validate n unrelated 1 bit message subsets. However, if we assume Bob and Mallory are given copies of the message, there may be ... 2 I had emailed Dr Thomas Pornin the very same question and received his reply. With his permission I cross post his answer as followed From: "Thomas Pornin" ... Date: 2021/04/22 11:38 Q1: Additional data k' is concatenated after bits2octets(H(m)) in HMAC input in step d. May we also need to concatenate k' after bits2octets(H(m)) in HMAC input in ... 2 encrypt with the private key, and decrypt with the public key That statement, and the very name privateEncrypt, is incompatible with standard terminology: "public" means known to all and opposes to "private"; and "encrypt" implies transforming some information$X$into$Y$in a way such that if$Y$becomes public,$X$does not. ... 2 It is totally possible and fairly easy to see without any advanced maths. The curve has order n (n Points in the curve) the private key d is [0... n-1] and the random number k [1... n-1] and there are 2^256 possible values for h. So there are n*(n-1)*2^256 possible inputs (d, k, h combinations). The output is r, s. Where r is there x part of a point so there ... 1 I'm still piecing things together, so bear with me as this may be revised. Access to a signature oracle is either a zero-knowledge resource or breaks the random oracle model for$H_k$. To see this we observe that anyone can generate valid$(m,s)$pairs for random values of$H_k$. They do this by picking arbitrary$s$in the required range, squaring to get a ... 1 The XMSS tree is constructed using the W-OTS keys. Each leaf of the XMSS tree corresponds to a distinct W-OTS key. The W-OTS keys have length$ln$, but each node of the XMSS tree should have length$n$. In order to make the size of the W-OTS keys compatible with the XMSS tree, the L-tree is used to first reduce the W-OTS key from$ln$to$n\$ bits.The L-tree ...