Tag
8 articles with this tag.
DSA and ECDSA stake everything on a secret random nonce that must never repeat. Sign two messages with the same nonce and the private key drops out with a little algebra. This guide runs the real attack against real DSA and secp256k1, the same flaw that broke the PS3 and drained Bitcoin wallets.
12 min read
Ed25519 is the EdDSA signature scheme on the Edwards curve of Curve25519, defined in RFC 8032. Learn how a 32-byte seed becomes a key, how a deterministic nonce replaces random numbers, how a signature is checked with the cofactor, and why the range check on S matters.
19 min read
GeMSS is a post-quantum signature scheme whose signatures have only a few hundred bits and whose public key is a system of quadratic equations. Learn how a hidden polynomial over GF(2^n) becomes a signature, how the signer finds roots, and why NIST dropped the scheme after a key-recovery attack.
41 min read
Picnic is a post-quantum signature scheme built only from a block cipher and a hash function. Learn how a zero-knowledge proof about a secret LowMC key becomes a signature, how three simulated parties hide the key, why 219 repetitions are needed, and why NIST did not select it.
36 min read
NIST's primary post-quantum signature standard works by signing, checking your own signature against a size limit, and throwing it away and starting over if it's too big. Learn how 'Fiat-Shamir with Aborts' turns a leaky lattice proof into a secure signature.
14 min read
Falcon produces the smallest signatures of any NIST post-quantum standard. It does that by solving a problem that broke the leading lattice signature schemes of the late 1990s/early 2000s. Learn the hash-and-sign paradigm, and why the naive version of it is fatally insecure.
13 min read
Rainbow signed messages using polynomial equations so tangled that solving them looks impossible. Then, in 2022, someone found a shortcut and broke it in a weekend on a laptop. Learn how it worked, and how it fell.
12 min read
Every other post-quantum signature scheme bets on a new hard math problem holding up. SPHINCS+ makes almost no new bet at all: its security rests on nothing but hash functions. Learn how a tree of one-time signatures becomes a full signature scheme.
11 min read
