# Is there a problem with this non-ECDSA message signing?

Is there a problem with signing a message like this?

p = the Elliptic Curve prime
G = base point
a = Alice’s private key
A = aG = Alice’s public key
e = hash(message)
Jx = x coordinate of J


In my target 32-bit microcontroller I am using p-256 and SHA256. Thus e will typically be in 1..p-1.

Alice computes:

e = hash(message)
E = eG
J = aE          using Alice’s private key


and sends Jx as signature

Recipient computes:

e = hash(message)
K = eA          using Alice’s public key
and validates Jx = Kx


The only problem I see is that e might be 0 or 1 or some value >= p. (If it is I have the flexibility to pad the message such that e is in a good range.)

Is there a problem if hash(msg) is greater or equal to the EC prime? Other than a few unusable values of e is there is a problem that makes this method less secure than ECDSA?

-
Just out of interest, why are you implementing your own scheme while there's scrutinized and already implemented solutions available, such as ed25519? – orlp Jul 6 '13 at 23:51
Perhaps it would help if you more clearly listed your underlying requirements. Since you are implementing the scheme in a microcontroller I presume you want to avoid a scheme that relies on random per message values or an internal state (such as ECDSA), and also that you want signature generation to be relatively cheap, but is it also essential that the signatures are short? – Henrick Hellström Jul 7 '13 at 7:57

-