1
$\begingroup$

When I sign a message (which has potentialy low entropy) using a private key and I send it without the original message, can the original message be retrieved from the signature(s)?

I want to prove – over an unsecure channel – that I know a secret password without revealing it.

Could a man-in-the-middle (who does not know the original message) create a signature using a different private key which would look like he knew the original message? That would give him the oppertunity to claim to also know the message without really knowing it.

$\endgroup$
1
$\begingroup$

When I sign a message (which has potentialy low entropy) using a private key and i send it without the original message, can the original message be retrieved from the Signaturen?

It depends.
If you use a signature scheme with appendix it will be impossible to recover the message using other ways than brute-force (so the answer would be "yes" for low-entropy). This is the usual case for most signature schemes (like RSASSA-PSS and ECDSA). If you use a signature scheme with message recovery (quite rare, like ISO/IEC 9796-2) you can indeed recover the message.

I want to prove over an unsecure channel that i know a secret password without revealing it

I suggest you give SRP a try for this.
It's specifically designed to combine password authentication with key-agreement (and thereby prove of knowledge of password).

Could a man in the middle who does not know the original message create a signature using a different private key which would look like he knew the original message?

A signer needs to know the message in order to be able to sign it. If you can create a signature that is valid without letting the signer ever see the message, you have successfully broken the standard definition of security for this scheme.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.