Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Given a private signature key sk and a public signature key SK, does revealing sk(H(SK)) (in addition to SK) make it more easy for an attacker to determine sk or to fake a signature that would appear to have been produced by sk? Is this scheme a bad idea - in other words, does it compromise the secuity of the signing algorithm? (It seems like this is analogous to key-dependent encryption, but for signatures, and with the interposition of a hash function in between).

If that matters, I'm using ECDSA signatures. Any pointers are appreciated.

share|improve this question
    
I'm not sure I understand the confusion. A fundamental requirement of a digital signature scheme is that it doesn't leak information about the secret. Otherwise an attacker can recover the secret and forge messages which would defeat the entire purpose. –  Stephen Touset Feb 4 at 0:40
    
Right. I'm wondering if this would be a special case that needs to be avoided. Not that I see an attack, it's just that I've never seen this been done and I'm wondering if it's cryptographically sound. –  louism Feb 4 at 1:00
    
@louism: It should be noted that your question is a good one in terms of encryption, where encrypting the key does lead to a different notion of security - key dependent messaging –  figlesquidge Feb 4 at 9:12
    
Would people really use a signature scheme were signing a piece of public information could compromise your signing key? Wouldn't that be an obvious catastrophic deficiency? –  David Schwartz Feb 4 at 20:02
    
@figlesquidge So there isn't an analogue to the "key-dependent encryption" attack for signatures ("key-dependent signatures")? –  louism Feb 5 at 2:45
add comment

1 Answer

up vote 6 down vote accepted

No, signing the hash of the public key cannot introduce a weakness on a secure signature scheme.

When we have a signature scheme, we assume that it is secure in an chosen text model, where the attacker has access to the public key, and can ask any text of his choosing to be signed. We can see that any such scheme (such as ECCDSA, or so we believe) cannot be specifically weak this way.

This is easy to see; suppose we had a weakness that was caused by this (whether it revealed the private key, or made it easier the create a forgery). What the attacker could do is hash the public key, and then ask that hash to be signed. If the public key system had a weakness, this signature would reveal it, hence showing that the signature scheme didn't meet the requirements of security in the first place.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.