New answers tagged

5

Signing the public key is safe. The general assumption is that the adversary is allowed to ask any message that he knows to be signed, and that operation must not leak information about the private key (or otherwise generate a signature for a message that was not signed by the legitimate signer). In this model, the adversary knows the public key (it's ...


2

The hash output length does not need to be larger than 512 bits; the ECDSA specification can handle any length. The curve secp521r1 is usually considered to provide 256 bits of security (even though it provides a bit more), see Table 2 of NIST SP 800-57 for example. Therefore, a 512-bit hash, i.e. SHA-512, should be fine ("The security strength of the hash ...


4

Supplying ECDSA with deterministic input doesn't make for a one-time signature—RFC 6979 chooses the per-signature secret as a deterministic but secret function of the message. However, there is a variant of ECDSA—or EdDSA—that could probably work. In ECDSA, a public key is a point $A$ on a curve with standard base point $G$, and a signature on a message $m$...


4

From SEC1 v2.0 (§4.1, pp. 43–47), a public key is a point $Q \in E$, and a signature on a message $m$ is a pair of integers $(r, s)$ satisfying the signature equation (condensed from several steps): \begin{equation*} r \stackrel?= f\bigl(x([H(m) s^{-1}]G + [r s^{-1}]Q)\bigr), \end{equation*} where $f\colon \mathbb Z/p\mathbb Z \to \mathbb Z/n\mathbb Z$ ...


2

Public keys in this system are very sparse: for any $x$ value there are at most two possible $y$ values satisfying $y^2 = x^3 + ax + b$ where $a$ and $b$ are the curve parameters, since the equation is quadratic in $y$. (And $x^3 + ax + b$ has a square root at all only for some values of $x$; by Hasse's theorem, the number of points on the curve can't be ...


4

In my opinion this may open door to a lot of attacks the attacker can use. Actually, public key signatures are designed to be used securely like this. When we design a signature method, we assume that the attacker can ask for a large number of messages of his choosing to be signed, and still try to ensure that the attacker cannot generate a valid signature ...


3

Active Authentication (AA henceforth) relies on RSA or ECDSA and allows you to sign data. However, as our is not meant to sign data you should not use it for that purpose. First of all, the only PKI that verifies the public key is that used for passive authentication of the passport - so you probably have to set up a separate PKI for it to be useful. ...


1

Yes, in the random oracle model, the hash of a BLS signature makes a VRF essentially as secure as the BLS signature scheme (provided the verifier accepts only the unique canonical encoding of each signature). This works because BLS signatures are unique. Fix a pairing $e\colon G_1 \times G_2 \to G_T$ on groups $G_1$ and $G_2$ of prime order. For any fixed ...


Top 50 recent answers are included