Given a private signature key sk and a public signature key SK, does revealing sk(H(SK)) (in addition to SK) make it more easy for an attacker to determine sk or to fake a signature that would appear to have been produced by sk? Is this scheme a bad idea - in other words, does it compromise the secuity of the signing algorithm? (It seems like this is analogous to key-dependent encryption, but for signatures, and with the interposition of a hash function in between).

If that matters, I'm using ECDSA signatures. Any pointers are appreciated.

  • $\begingroup$ I'm not sure I understand the confusion. A fundamental requirement of a digital signature scheme is that it doesn't leak information about the secret. Otherwise an attacker can recover the secret and forge messages which would defeat the entire purpose. $\endgroup$ Commented Feb 4, 2014 at 0:40
  • $\begingroup$ Right. I'm wondering if this would be a special case that needs to be avoided. Not that I see an attack, it's just that I've never seen this been done and I'm wondering if it's cryptographically sound. $\endgroup$ Commented Feb 4, 2014 at 1:00
  • $\begingroup$ @louism: It should be noted that your question is a good one in terms of encryption, where encrypting the key does lead to a different notion of security - key dependent messaging $\endgroup$ Commented Feb 4, 2014 at 9:12
  • $\begingroup$ Would people really use a signature scheme were signing a piece of public information could compromise your signing key? Wouldn't that be an obvious catastrophic deficiency? $\endgroup$ Commented Feb 4, 2014 at 20:02
  • $\begingroup$ @figlesquidge So there isn't an analogue to the "key-dependent encryption" attack for signatures ("key-dependent signatures")? $\endgroup$ Commented Feb 5, 2014 at 2:45

1 Answer 1


No, signing the hash of the public key cannot introduce a weakness on a secure signature scheme.

When we have a signature scheme, we assume that it is secure in an chosen text model, where the attacker has access to the public key, and can ask any text of his choosing to be signed. We can see that any such scheme (such as ECCDSA, or so we believe) cannot be specifically weak this way.

This is easy to see; suppose we had a weakness that was caused by this (whether it revealed the private key, or made it easier the create a forgery). What the attacker could do is hash the public key, and then ask that hash to be signed. If the public key system had a weakness, this signature would reveal it, hence showing that the signature scheme didn't meet the requirements of security in the first place.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.