In RSA signature scheme, it is a common practice to 'sign' the hash value of the message so that the length can be fit.

Question: If we have $s=m^d \bmod n$ where $d$ satisfies $ed \equiv 1 \pmod{n}$ and we also know $s$ and $m$, is this still considered secure?

  • $\begingroup$ Moved comment to an answer. $\endgroup$ Oct 30 '14 at 14:00
  • $\begingroup$ Is the above supposed to be a signature scheme? If so, how would someone verify it? What would need to be in the public key? Hint: $n$ and $e$ are not sufficient. $\endgroup$
    – poncho
    Oct 30 '14 at 14:02
  • $\begingroup$ Yes, I'm not exactly sure what he asks, but whatever version of this without any hashing, the malleability problem stays. $\endgroup$ Oct 30 '14 at 14:03

The main problem here is that signature is malleable. Given signatures on $m_1$ and $m_2$ allows you to construct a valid signature on $m_1m_2$ by multiplying the signatures. Therefore, the answer is no. When you hash you don't have $H(m_1m_2)=H(m_1)H(m_2)$, so hashing destroys this algebraic structure that connects messages and signatures.

EDIT: I'm assuming the question is whether you can sign without hashing when the messages to be signed are already intergers modulo $n$, i.e. you don't need to hash your messages to make them elements of this group.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.