0
$\begingroup$

I would like to refer you to page 430 of the Handbook of Applied Crypto, where the authors said "... reordering of multiple signed blocks presents a security risk..."

This statement was made in reference to not breaking messages into fixed lengths which can then be signed individually using signature schemes with message recovery.

My question is

  1. How does the security risk arise?
  2. If I do not want to include a hash function for signature schemes with appendix, can I break the message up into blocks of fixed lengths and sign each block?

Thanks for your help!

$\endgroup$

1 Answer 1

1
$\begingroup$

How does the security risk arise?

Because you can simply drop or reorder signatures for single block. Assume you have a message $m$ and you split it up in blocks $(m_1,m_2,\ldots,m_n$) and get signatures $(\sigma_1,\sigma_2,\ldots,\sigma_n$). Then you could just drop for instance $\sigma_2$ and get a signature for message $(m_1,m_3,\ldots,m_n)$. You can also replace arbitrary sub-signatures, e.g., $(\sigma_2,\sigma_1,\ldots,\sigma_n)$ which is a valid signature for $(m_2,m_1,\ldots,m_n)$. Now you could say that you introduce increasing sequence numbers, but if you got two signatures you could simply exchange sub-signatures from these two signatures to obtain valid signature for "mixed messages". Ok, now you could say you use unique sequence numbers per message, but there may be too many other attacks that you do not consider.

If I do not want to include a hash function for signature schemes with appendix, can I break the message up into blocks of fixed lengths and sign each block?

So why introducing such additional assumption where you may overlook something that is specific to your application scenario.

Besides removing these problems it is far more efficient to firstly hash the message before signing and then sign a single block.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.