# RSA Signature Forgery

We all know that x509 certificates carry a signature that represents the certificate digest encrypted by the private key of the issuer.

I believe that the digest is encrypted only providing one block, so it will represent an unique congruence in the multiplicative group space. It doesn't matter if two digest are very similar. Hash functions are used to reduce the message length, so data has not to be separated in chunks since length is less than the modulus length.

But I started to wondering what would happen if the CA enciphers the digest chunk by chunk.

For example we could obtain a similar digest of a legit certificate that differs in the last $n$ bits. So we will have almost the same congruences (ciphertext) comparing to the original signature. This ends in brute forcing the different chunks. I know that this isn't the real case, and also, that nobody ciphers a message that is bigger in size than the modulus.

As a consecuence, are hash functions used to reduce the message length so its less in size than the modulus? Can be the data partitioned in chunks and then ciphered by the private key when dealing with signatures?

• Signature is not "encryption using the private key". That's an outworn interpretation of RSA signatures which does not carry over to other public-key ciphers. – yyyyyyy Jun 27 '15 at 23:02
• The signature is the congruence resulting of modular exponentiation taking the whole digest as a base raised to the private key. This is the way a signature is constructed. I named it as an encryption. – kub0x Jun 27 '15 at 23:08
• I just wanted to know when is the data partitioned into chunks for signing and also if hash functions are performed before data signing in order to pass only one block. Thanks – kub0x Jun 28 '15 at 12:20
• There is a reason why even the authors of PKCS#1 went out of their way to create a different name for modular exponentiation as used for signature generation and encryption. "I named it as an encryption" is the same as saying "I think I know better than the authors or RSA on how to define the terms". Please stop the confusion. – Maarten Bodewes Jun 28 '15 at 13:59
• Sorry for that. Encryption doesn't require a message digest, but signature generation over a message does. Could you answer the related question to this topic? Thanks. – kub0x Jun 28 '15 at 14:06