Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In RSA signature scheme, it is a common practice to 'sign' the hash value of the message so that the length can be fit.

Question: If we have $s=m^d \bmod n$ where $d$ satisfies $ed \equiv 1 \pmod{n}$ and we also know $s$ and $m$, is this still considered secure?

share|improve this question
Moved comment to an answer. – Edvard Fagerholm Oct 30 '14 at 14:00
Is the above supposed to be a signature scheme? If so, how would someone verify it? What would need to be in the public key? Hint: $n$ and $e$ are not sufficient. – poncho Oct 30 '14 at 14:02
Yes, I'm not exactly sure what he asks, but whatever version of this without any hashing, the malleability problem stays. – Edvard Fagerholm Oct 30 '14 at 14:03
up vote 1 down vote accepted

The main problem here is that signature is malleable. Given signatures on $m_1$ and $m_2$ allows you to construct a valid signature on $m_1m_2$ by multiplying the signatures. Therefore, the answer is no. When you hash you don't have $H(m_1m_2)=H(m_1)H(m_2)$, so hashing destroys this algebraic structure that connects messages and signatures.

EDIT: I'm assuming the question is whether you can sign without hashing when the messages to be signed are already intergers modulo $n$, i.e. you don't need to hash your messages to make them elements of this group.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.