RSA Signature - Multiple Use Weakness

Question

I cite from Fundamentals of Computer Security (Chapter 7 on Digital Signature, Paragraph 7.3 on RSA Signatures, page 289):

Multiple uses of the RSA Signature scheme tend to weaken it. The way out is to make subsequent signatures dependent on those previously generated.

• Why is this?
• Does it affect also the RSA Encryption scheme, or is it a weakness that comes from the knowledge of the message (and therefore affects only Signature schemes)?

Answer 1

It's hard to say from that out-of-context statement. It may be that they were talking about signatures with obsolete padding schemes (such as ISO 9796-1), or possibly just raw RSA (zero padding, which is even worse); it is possible with these padding, if you observe enough signatures, you could come up with a forgery.

On the other hand, there is no known weakness if you generate RSA signatures using a modern padding scheme, either PKCS #1.5 (which, I suppose, is a bit hard to call modern) or PSS.