In RSA signature scheme, it is a common practice to 'sign' the hash value of the message so that the length can be fit.

Question: If we have $s=m^d \bmod n$ where $d$ satisfies $ed \equiv 1 \pmod{n}$ and we also know $s$ and $m$, is this still considered secure?

  • $\begingroup$ Moved comment to an answer. $\endgroup$ Commented Oct 30, 2014 at 14:00
  • $\begingroup$ Is the above supposed to be a signature scheme? If so, how would someone verify it? What would need to be in the public key? Hint: $n$ and $e$ are not sufficient. $\endgroup$
    – poncho
    Commented Oct 30, 2014 at 14:02
  • $\begingroup$ Yes, I'm not exactly sure what he asks, but whatever version of this without any hashing, the malleability problem stays. $\endgroup$ Commented Oct 30, 2014 at 14:03

1 Answer 1


The main problem here is that signature is malleable. Given signatures on $m_1$ and $m_2$ allows you to construct a valid signature on $m_1m_2$ by multiplying the signatures. Therefore, the answer is no. When you hash you don't have $H(m_1m_2)=H(m_1)H(m_2)$, so hashing destroys this algebraic structure that connects messages and signatures.

EDIT: I'm assuming the question is whether you can sign without hashing when the messages to be signed are already intergers modulo $n$, i.e. you don't need to hash your messages to make them elements of this group.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.