1
$\begingroup$

Why use a random padding on RSA encryption and not on RSA signature?

$\endgroup$
1
$\begingroup$

TL;DR: The security definitions ask for different properties.

The usual security definition for public key encryption, asks you, the attacker, to distinguish which message (out of two) was encrypted and you're seeing the ciphertext of. Obviously you can't succeed at defending in this if you don't randomize, because otherwise an attacker could just encrypt the messages himself and compare the results. Also see our canonical answer for the details.

For signature schemes on the other hand, the usual security definition asks you (the attacker) to find a $(m,s)$-pair (where $m$ is a message and $s$ is its corresponding signature) that you haven't seen before or that you haven't received from the oracle (ie any ressources you're allowed to use). As you can see, there's nothing that would require for randomness in this definition and as such there are fully deterministic schemes with "provable" security, such as RSA-FDH.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.