Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I reference object in some of my code in hashes. The signature is itself is another object separate from the one I am signing (for obvious reason). I consider simpler to simply sign the reference to my object (it's hash), but I wonder if it is considered secure.

Here's a more complete explanation:

A: Is the data object to be hash then signed
H: Is hash(a), the reference to A
S: Is the signature object which contain H and sign(H)

S and A are sent on the network so A can be verified with its signature

Hash algorithm is SHA-256 and signature one is ECDSA.

share|improve this question
add comment

3 Answers

up vote 7 down vote accepted

Most signature schemes actually incorporate a one-way function (hash) in the algorithm. Partly this is necessary to be able to sign an arbitrarily large message at all, partly this is necessary to avoid some kinds of forgery attacks on the signature scheme (often it is easy to find a "signature" which is valid, but due to the one-way function it is not easy to find a fitting message).

And as long as your hash function is collision-resistant, an additional hash is not a problem. (This means: Don't use MD5 here. But with SHA-2 you should be safe.)

As a general idea, all used algorithms should have a security level of at least the level you want to achieve – for (non-broken) hash functions, this generally means $2n$ bit output for $n$-bit security, a similarly large elliptic curve (for EC-signature), and modular discrete log or RSA signature keys should be correspondingly even larger (see keylength.com for a comparison).

share|improve this answer
    
Of course I would never use MD5 for that purpose. –  Gopoi Feb 13 '13 at 17:01
    
OK answer, but I would add something about the security of the used algorithms. It's possible but not advisable to hash something using SHA-1 before encrypting it with a very secure key (e.g. one created for a 521 bit NIST curve). –  owlstead Feb 13 '13 at 22:36
add comment

This is secure, and a lot of systems actually do signatures this way (for example, PGP). One reason to do this for performance. Signing a hash is much faster than signing your whole message. It is also non-trivial to hash large messages since signature functions usually operate on a bounded size input.

An attacker will have just as much difficulty forging a signature on the hash as they would forging the signature on the message itself.

share|improve this answer
    
Perfect what I wanted to ear. –  Gopoi Feb 13 '13 at 5:23
    
Actually, most signature primitives (i.e. when used without a hash) can only sign a limited amount of data (in the order of the key size). It is not clear at all how signing a larger message would look like, so you can't say that the performance is the reason. –  Paŭlo Ebermann Feb 13 '13 at 20:58
    
@PaŭloEbermann I've added that to the answer. –  Oleksi Feb 13 '13 at 21:03
add comment

There is no meaningful distinction between these two things. Consider this scheme:

  1. Hash the object.

  2. Sign the hash.

Now, does this scheme sign the hash or the full object? Step 2 signs the hash. But the scheme signs the full object. So which is it?

share|improve this answer
    
I guess they both sign the data. Hey! you are on bitcoin too....Well Hi! –  Gopoi Feb 13 '13 at 5:25
    
I have met several case where there has been great confusion about that. For example, in a GlobalPlatfrom context, the signature of an applet may be the signature of the hash of the applet, where signature includes a further hashing step (thus, the hash gets re-hashed). Then there is the question of if we sign the hash, or the dreaded ASN.1 encoding of the hash; and which hashes these are; and if the indication of the hashing scheme within the signature is encoded in the signature, or implicit... –  fgrieu Feb 13 '13 at 14:43
    
The great thing about standards is that there are so many to choose from. –  David Schwartz Feb 13 '13 at 14:59
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.