# Tag Info

2

The specification mentions that the signature is per ECDSA on curve "P-256" (aka secp256r1), or RSASSA-PSS with a modulus of 2048 bits in combination with the SHA–256 hash (I guess with empty salt, and MGF1 with SHA-256). These are state-of-the-art, unbroken algorithms. I find it unbelievable that a cryptographic attack would let emit fake passes ...

1

Your certificate contains a public key, the P-256 or secp256r1 or prime256v1 you can see here. However, the key is in uncompressed format (starting with a byte 04 and then 64 random looking bytes) and the domain parameters are specified using an OID with the curve mentioned above. So the only coordinates are those of the public key, and those are always the ...

0

You actually need a family of second-preimage resistant, undetectable, one-way functions. In general, any secure cryptographic hash function (SHA2, SHA3, ...) should work with a little tweak to make it keyed. You do not need it to be a PRF, and the function is fixed length. Hence, if you also fix the key length, using SHA3(K || M) is fine (and then taking ...

0

Can a subordinate key be used to sign others' keys instead? No, not according to the OpenPGP Proposed Standard. A subordinate key (a subkey) cannot sign (certify) others' keys instead of the master key (the primary key). I know I can create the signing key... Yes, you can create a signing key (a subkey), but it is just for that, signing, and not for ...

5

So, I’m wondering how much data can be verified by an electric signature? If you're asking about how much data that a single public key signature can handle, well, there's no realistic limit. What every signature system (at least, every one that I've heard of) does is take the message, pass it through a hash function to generate a short hash (and then ...

5

In public-key cryptography, there is NO SUCH THING as "encrypt with private key". It's a misnomer since the RSA days. Also, what you describe as "M = function(pubkey, signature)" is signature with message recovery. These algorithms are rare nowadays and had been largely replaced with signature with appendix (which ECDSA is one of them). ...

1

The height of the merkle tree is an independent parameter. The Winternitz parameter — $w$ — comes up because to sign or verify a WOTS+ signature the first step is to encode your message as a list of integers from $0$ to $w - 1$ (inclusive). For example the string "hello" is encoded in ascii as 01101000 01100101 01101100 01101100 01101111. If $w$ ...

6

Is it legit? No, and you hit on the reason - the algorithm converts the message into a series of 16 values from 1 to 128, and then signs based only on that. That's a total of 112 bits; actually, it's somewhat worse than that, as the algorithm they use to convert the message hash into the series of 16 values will generate values that always sum (mod 128) to ...

0

You can use key usage as digitalSignature only to create a self-signed signing certificate for signing documents. You can also use Microsoft proprietary Document Signing EKU: https://www.alvestrand.no/objectid/1.3.6.1.4.1.311.3.10.3.12.html. Additionally, you can add the following: keyUsage nonRepudiation (Good to have, since CA add this in document ...

0

The paper Structure-Preserving Signatures and Commitments to Group Elements presents a commitment scheme for committing to (vectors of) group elements, and a signature scheme which outputs signatures (on vectors of group elements) as group elements. Composing these two should be straightforward for your needs.

Top 50 recent answers are included