Cryptography Stack Exchange
Cryptography Stack Exchange

Questions tagged [elgamal-signature]

A digital signature scheme based on the discrete logarithm problem, published by Taher ElGamal in 1984. Not to be confused with the ElGamal encryption system.

The ElGamal signature scheme is a digital signature scheme published by Taher ElGamal in 1984. Like the ElGamal encryption system, which was described in the same paper,[1] its security is based on the assumed difficulty of the discrete logarithm problem.

A variant of the ElGamal signature scheme was standardized as the Digital Signature Algorithm (DSA).

See also:

References:

  1. T. ElGamal (1985). "A public key cryptosystem and a signature scheme based on discrete logarithms". IEEE Trans inf Theo 31 (4): 469–472. Appeared earlier in the proceedings to Crypto '84.
88 questions
3
votes
1 answer

ElGamal signature - exploiting fallacious implementation

This question is related to ElGamal signature scheme as defined here ElGamal signature without calculating the inverse Show how one could exploit an implementation ElGamal signature scheme in which it is not checked that $0 \leq \gamma \leq…
Azooo
  • 225
  • 1
  • 5
3
votes
1 answer

El Gamal signature scheme variant

Suppose we have the following El Gamal digital signature scheme variant: We fix a prime number $p$ and a generator $g$ of the group $Z_p^*$. We choose $x \in Z_{p-1}^*$, which is going to be our secret key and we compute $y = g^x \pmod{p}$, which is…
blaze9
  • 33
  • 4
3
votes
1 answer

Recovering the key in an ElGamal Signature Scheme variant

From page 318 in Stinson's "Cryptography: Theory and Practice", question 7.3: Suppose that Alice is using ElGamal Signature Scheme. In order to save time in generating >the random numbers k that are used to sign messages, Alice chooses an initial…
BigDamnHero
  • 33
  • 1
  • 5
3
votes
0 answers

Why does the ElGamal signature have the specific form that it does?

In the original paper, ElGamal(1985) starts his discussion of signatures by saying: "The signature ..... is chosen such that the equation: $\alpha^m = y^r r^s \text{mod p}$ (equation 3 from the paper) is satisfied." (In this paper: $m$ is the…
DrEntropy
  • 163
  • 4
3
votes
1 answer

ElGamal signature scheme: Why is r included in s

In the ElGamal signature scheme we calculate a signature for a (hashed) message $m$ as $r \equiv_p g^k$, $s \equiv_{p-1} (m - xr) k^{-1}$ and verify it by checking $g^m \equiv_p y^r r^s$. Here $r$ is a group element which is in some cases used as an…
jederik
  • 165
  • 4
3
votes
1 answer

Occasional failure of an attack on ElGamal signature

I am following the procedure described on p. 319 of the fourth edition of Douglas Stinson and (since that edition) Maura Paterson's Cryptography − Theory and Practice (IBSN 978-1-03-247604-9). The context is recovery of the nonce $k$ in ElGamal…
user109426
  • 33
  • 3
2
votes
1 answer

ElGamal signature - show that $(\gamma, \delta)$ signs $m$

We have as a given: $gcd(j, p − 1) = 1$. $$γ = \alpha^i \beta^j \bmod p $$ $$ \delta = −\gamma j^{-1} \bmod (p−1) $$ $$m = i \delta \bmod (p − 1)$$ I want to show that $(\gamma; \delta)$ is an ElGamal signature for message $m$. In this book, they…
Tina Ch
  • 115
  • 2
2
votes
2 answers

How to find $r$ for El-Gamal signature with known private key

For public key $(g,b,P)$ and private key $x$ I have that... x = 8437809068483222013573558289468531414326215630180218801941732905 P = 7339893940555892950021117953932742794751344995120378281984000000000001 g = 89 b =…
Math4Life
  • 131
  • 1
2
votes
0 answers

Recovering El Gamal secret key from signatures

Assume out of a set of ElGamal signatures, I've discovered that two have the same y i.e. $signature_{1}$ on $m_{1}$ = $(y,s_{1})$ and $signature_{2}$ on $m_{2}$ = $(y,s_{2})$. The public keys for $signature_{1}$ and $signature_{2}$ and messages…
byteBiter
  • 153
  • 5
1
vote
1 answer

Why $s=0$ is not allowed in Elgamal signature?

In Elgamal signature scheme $\text{sig}_{k_{pr}}(x,k_E)=(r,s)$, $s=0$ is not allowed. How does this lead to finding the private key $d$?
Mohammadsadeq Borjiyan
  • 73
  • 5
1
vote
2 answers

Inverse in ElGamal signature

I am learning about ElGamal signature verification. During the signature generation one has to choose a k such that 1 < k < p − 1 and gcd(k, p − 1) = 1. I am using the notation from the Wikipedia site. Later it is used the inverse of k. I assume…
robert
  • 253
  • 2
  • 10
1
vote
2 answers

Role of Fermat's little theorem in the proof of correctness of ElGamal signature

In the Wikipedia article about the ElGamal signature scheme it is written, that Fermat's little theorem is used in the following proof of correctness: From the signature generation in ElGamal we can derive, that: $$H(m) \equiv xr + sk \pmod…
user30887
  • 39
  • 4
1
vote
1 answer

For $p=23$, $g=2$, $q=11$ you are given the signature $(18,3)$ in the message $m=2$. Construct a signature in the message $m'=3$

Alice uses an ElGamal signature in group $(Z/pZ)^{*}$ without using hash function. To sign the message $m \in (Z/pZ)^*$ calculates the signature $(r,s)$ as follows: choose random $k \in \{0, 1, \dots, q-1\}$ where $q/p-1$ is prime number and the…
Legolas
  • 121
  • 3
1
vote
2 answers

El-Gamal signature with two messages

Alice uses an ElGamal signature with base the group $Z^*_{107}$ and parameter $g=3$ of order $q=53$.The private key of Alice is some $x \in \{0,1,.....,52\}$ and the public key of her is $y=10$. To sign the message m, she calculates $r=g^k \bmod107$…
Paris Lamp
  • 129
  • 5
1
vote
1 answer

Slight modification of El Gamal signature scheme is not secure?

A slight modification of El Gamal signature scheme would be to compute: $r = g^k$ for some random k (as usual) but $s$ as: $s = (hash(m) - x)k^{-1} \mod (p-1) $ (instead of $(hash(m)-xr)k^{-1} \mod p - 1$). The verification procedure would be to…
Saroupille
  • 113
  • 3
1
2