Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For primes p and q used to create a keypair, I understand that the following operation is used to create a signature:

$M^d (\bmod\ N)$

where d and N have their usual meanings and M is the message. In this case, however you need to possess the public key in order to verify the signature S as follows :-

$S^e (\bmod\ N)$

In the case of a certificate (CA signed or self signed), is the plaintext public key part of it?

share|improve this question
This is NOT a secure signature scheme. If you have two messages signed, you can compute a signature of their product simply multiplying their signatures. – antosecret Apr 29 '13 at 8:52
In addition, the word "plaintext" is used in contrast with "ciphertext", that we do not have in the case of signatures. To answer your question, the message is not part of the certificate, while the public key used to verify the signatures is. – antosecret Apr 29 '13 at 8:58

To sign a message $M$ under RSA, one should NOT build the signature as $\mathcal{Sign}(M)=M^d\bmod N$, for several reasons:

  • either that limits to messages $M$ in range $[0..N-1]$, or that allows forgeries of the form $\hat M=M+k\cdot N$, because $\mathcal{Sign}(\hat M)=\mathcal{Sign}(M)$;
  • that allows forgeries of the form $\hat M=R^e\cdot\prod{M_j}^{a_j}$ because $\mathcal{Sign}(\hat M)=R\cdot\prod{\mathcal{Sign}(M_j)}^{a_j}\bmod N$.

For some safe ways to use RSA to build signatures, see PKCS#1 or ISO/IEC 9796-2 (the first signs short messages only, therefore it is customary to use it to sign a hash of a message, rather than the message; the second always use a hash).

Public key certificates are signed messages including a public key, and additional informations usually including the identity of the legitimate holder of the corresponding private key, the identity or/and reference of the signer, the rights of the holder of the private key...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.