# Reordering of multiple signed blocks

I would like to refer you to page 430 of the Handbook of Applied Crypto, where the authors said "... reordering of multiple signed blocks presents a security risk..."

This statement was made in reference to not breaking messages into fixed lengths which can then be signed individually using signature schemes with message recovery.

My question is

1. How does the security risk arise?
2. If I do not want to include a hash function for signature schemes with appendix, can I break the message up into blocks of fixed lengths and sign each block?

Thanks for your help!

## 1 Answer

How does the security risk arise?

Because you can simply drop or reorder signatures for single block. Assume you have a message $m$ and you split it up in blocks $(m_1,m_2,\ldots,m_n$) and get signatures $(\sigma_1,\sigma_2,\ldots,\sigma_n$). Then you could just drop for instance $\sigma_2$ and get a signature for message $(m_1,m_3,\ldots,m_n)$. You can also replace arbitrary sub-signatures, e.g., $(\sigma_2,\sigma_1,\ldots,\sigma_n)$ which is a valid signature for $(m_2,m_1,\ldots,m_n)$. Now you could say that you introduce increasing sequence numbers, but if you got two signatures you could simply exchange sub-signatures from these two signatures to obtain valid signature for "mixed messages". Ok, now you could say you use unique sequence numbers per message, but there may be too many other attacks that you do not consider.

If I do not want to include a hash function for signature schemes with appendix, can I break the message up into blocks of fixed lengths and sign each block?

So why introducing such additional assumption where you may overlook something that is specific to your application scenario.

Besides removing these problems it is far more efficient to firstly hash the message before signing and then sign a single block.