Using RSA for signing & verification, is there a way to take a valid signature for an unknown message, and for someone else to generate a valid signature using a different key against the valid signature, given knowledge of the original public key?
First, let me describe how I understand signing/verification with RSA:
You start with a keypair with modulous $N$ that is the product of two large primes, along with integers $e$ and $d$ such that $e d ≡ 1 \pmod {\varphi(N)}$, where $\varphi$ is the Euler phi-function. The signer's public key consists of $N$ and $e$, and the signer's secret key contains $d$.
To sign something, the signer computes $\sigma ≡ m^d \pmod {N}$. To verify, the receiver checks that $\sigma^e ≡ m \pmod N$.
( http://en.wikipedia.org/wiki/Digital_signature#How_they_work )
What are the risks to making $\sigma$ public, if $m$ is kept secret, along with the signers private key, $d$?
The public key, $N$ and $e$, is public, as is $\sigma$, the signature.
$\sigma^e$ is easily calculatable, which gets us $m \pmod N$, but not $m$ itself.
Given $m \pmod N$ but an unknown $m$, what can we do with it?
Can a second signer, with public key $N^{\prime}$ and $e^{\prime}$, and private key $d^{\prime}$ be used to generate $\sigma^{\prime} = m^{d^{\prime}} \pmod {N^{\prime}}$?
How resistant to brute forcing is that? How about if some sort of verification oracle is available?
Since $m \pmod N$ is lossy, without $m$ (or more likely $\text{pad}(\text{hash}(m))$ in practice), is anything about $m$ recoverable?
Is there another system for signing whose signatures are of less use without the message?