# Certificate == signed public key

For primes p and q used to create a keypair, I understand that the following operation is used to create a signature:

$M^d (\bmod\ N)$

where d and N have their usual meanings and M is the message. In this case, however you need to possess the public key in order to verify the signature S as follows :-

$S^e (\bmod\ N)$

In the case of a certificate (CA signed or self signed), is the plaintext public key part of it?

-
This is NOT a secure signature scheme. If you have two messages signed, you can compute a signature of their product simply multiplying their signatures. –  antosecret Apr 29 '13 at 8:52
In addition, the word "plaintext" is used in contrast with "ciphertext", that we do not have in the case of signatures. To answer your question, the message is not part of the certificate, while the public key used to verify the signatures is. –  antosecret Apr 29 '13 at 8:58

## 1 Answer

To sign a message $M$ under RSA, one should NOT build the signature as $\mathcal{Sign}(M)=M^d\bmod N$, for several reasons:

• either that limits to messages $M$ in range $[0..N-1]$, or that allows forgeries of the form $\hat M=M+k\cdot N$, because $\mathcal{Sign}(\hat M)=\mathcal{Sign}(M)$;
• that allows forgeries of the form $\hat M=R^e\cdot\prod{M_j}^{a_j}$ because $\mathcal{Sign}(\hat M)=R\cdot\prod{\mathcal{Sign}(M_j)}^{a_j}\bmod N$.

For some safe ways to use RSA to build signatures, see PKCS#1 or ISO/IEC 9796-2 (the first signs short messages only, therefore it is customary to use it to sign a hash of a message, rather than the message; the second always use a hash).

Public key certificates are signed messages including a public key, and additional informations usually including the identity of the legitimate holder of the corresponding private key, the identity or/and reference of the signer, the rights of the holder of the private key...

-