xorhash
  • Member for 2 years, 1 month
  • Last seen more than 1 year ago
ECDSA signature verification checks
Accepted answer
6 votes

The original paper (Don Johnson, Alfred Menezes, Scott Vanstone. The Elliptic Curve Digital Signature Algorithm (ECDSA), International Journal of Information Security volume 1, 2001, pp. 36–...

View answer
Is there any patent free EC point compression available? If not, should I GPL/LGPL my code?
Accepted answer
6 votes

Classic affine point compression, storing only the x-coordinate and a single bit of the y-coordinate, is claimed in two different U.S. patents: US 6,141,420: “The inventors have also recognized ...

View answer
Can the EdDSA signature scheme be customized with OpenSSL?
Accepted answer
4 votes

The first thing to clarify is the definition of “EdDSA”. EdDSA was introduced in Bernstein et al.'s High-speed high-security signatures in 2011. Various parameters it implicitly assumed were declared ...

View answer
Construction of secure Elliptic Curve subgroup over a much larger field
4 votes

Hasse's theorem notes that for an elliptic curve over a finite field with $\mathcal{Q}$ elements (which would mean $\mathcal{Q}=p$ for a prime field $\mathbb{F}_p$) that has $N$ points, the following ...

View answer
Compact ROM with space only for EdDSA. How to fit a key exchange algorithm inside?
3 votes

A bit of nomenclature first: “Ed25519” is defined to refer to the EdDSA signature algorithm over the edwards25519 curve. What you appear to actually mean is whether you can reuse your edwards25519 ...

View answer
Why does ed25519 seem to accept and use 96-byte / 384-bit signatures?
Accepted answer
3 votes

This is likely an artifact of the API used in the specific piece of code you're using. This piece of code follows the NaCl API, which verifies the input as the concatenation of signature and message (...

View answer
Weaker alternative to Ed25519?
2 votes

While Bristol's answer solves the problem of finding any 112-bit curve, it's not actually a proper alternative to Ed25519 in the sense that it isn't a (twisted) Edwards curve. I state again, agreeing ...

View answer
Is it possible to verify a clearsigned message with a short public key (fingerprints)?
Accepted answer
2 votes

No, it isn't possible to use a fingerprint as a key to verify signatures. The PGP fingerprint is a hash of the public key material, see RFC 4880 section 12.2; it doesn't actually contain the public ...

View answer
When using Ristretto or Decaf with Ed25519 and Ed448, do scalars still need pruning/trimming/clamping?
Accepted answer
2 votes

The answer is contained in the Decaf paper [H2015], p. 3 already. Clearing the top bit(s). This appears to be just to get the scalar value $s$ in the range of $0 \le s < \ell$ (with an ...

View answer
Test Vectors for XEdDSA
2 votes

Open Whisper Systems' own curve25519-java repository has a few test vectors in the code in android/jni/ed25519/tests/. From xeddsa_fast_test(), you get this test vector in particular: Private key is ...

View answer
Unique GCM/CCM initial counters without recipient side message counters
2 votes

Perhaps a workaround for this would be to instead use deterministic nonce generation with AES-GCM-SIV, which has been formally proposed in a paper by Shay Gueron and Yehuda Lindell. The core idea is ...

View answer
How to specify last $t$ bits are only sent when a signature is sent?
1 votes

In general, this depends entirely on the signature scheme in question; usually however, the answer is that truncation is generally not possible. For very short signatures, depending on your risk ...

View answer
What are the extended homogeneous coordinates in the EdDSA specification?
Accepted answer
0 votes

Extended homogeneous coordinates are a different form of coordinates that provide particularly fast methods of point addition and point doubling formulas for twisted Edwards curves, introduced in ...

View answer