1
$\begingroup$

If I have N bytes of plaintext, does signing it with my private key prove (to holders of my public key) that I have signed that exact plaintext messages?

i.e. could an attacker use the plaintext and signature to generate another plaintext which would also verify?

Or do I need to hash the plaintext to provide message integrity?

|improve this question
$\endgroup$
  • 1
    $\begingroup$ How would you sign a message using ECC without hashing? And which ECC signature algorithm are you talking about? ECDSA? $\endgroup$ – CodesInChaos Nov 2 '15 at 12:08
  • $\begingroup$ @CodesInChaos I think I may be being an idiot - I'm just struggling to understand Bouncy Castle's signing API. Perhaps hashing is being done for me, under the hood? $\endgroup$ – Thomas Von Panom Nov 2 '15 at 12:34
  • 3
    $\begingroup$ I'm not familiar with the BC signing API, but it's very likely that it does hash the message internally. $\endgroup$ – CodesInChaos Nov 2 '15 at 12:35
  • $\begingroup$ @CodesInChaos I was being an idiot. Found the right call now and it's obvious: Signature dsa = Signature.getInstance("SHA256withECDSA"); $\endgroup$ – Thomas Von Panom Nov 2 '15 at 13:00
  • $\begingroup$ You don't need to hash - typically hashes are used to implement the random oracle used in the proof of security of a signature scheme, but there exist signature schemes that don't use random oracles. $\endgroup$ – pg1989 Jan 3 '16 at 5:27
1
$\begingroup$

A signature algorithm should - in general - be thought to contain the hashing method as parameter. Take for instance RSA / PSS. RSA / PSS includes the EMSA-PSS-ENCODE operation. Here the hash function to use is an option to the algorith.

Step 2 is:

Let mHash = Hash(M), an octet string of length hLen.

where M is the message to be signed.

"Or do I need to hash the plaintext to provide message integrity?" is therefore a question that is non-sensical for most signature definitions. RSA has deprecated modes that directly sign a message (with message recovery) but those are generally not used. ECDSA is also defined for use with a hash function and EC crypto cannot easily "encrypt the message" with the private key for signature generation.

As you have found out, Signature dsa = Signature.getInstance("SHA256withECDSA"); uses SHA-256 as an option to ECDSA. The hashing will then be performed internally.

Sometimes hash value or intermediate hash value is used as input for signature generation. This can be useful when the device that performs the private key generation is limited in hashing bandwith. E.g. for a smart card you may not want to send all the data to the smart card - sending just the hash is much more efficient.

|improve this answer
$\endgroup$
-1
$\begingroup$

Assuming your signature scheme is non-malleable, it is sufficient to encrypt the message using your private key.

The purpose of using digest is to reduce the size of the data to be encrypted. The digest used in such case should be cryptographically secure.

|improve this answer
$\endgroup$
  • 8
    $\begingroup$ "encrypt the message using your private key" is already a dubious description of RSA. For ECC it's completely nonsensical. Encryption using ECC (ElGamal or ECIES) is very different from how ECC signatures work. $\endgroup$ – CodesInChaos Nov 2 '15 at 13:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.