Why use a random padding on RSA encryption and not on RSA signature?
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
TL;DR: The security definitions ask for different properties.
The usual security definition for public key encryption, asks you, the attacker, to distinguish which message (out of two) was encrypted and you're seeing the ciphertext of. Obviously you can't succeed at defending in this if you don't randomize, because otherwise an attacker could just encrypt the messages himself and compare the results. Also see our canonical answer for the details.
For signature schemes on the other hand, the usual security definition asks you (the attacker) to find a $(m,s)$-pair (where $m$ is a message and $s$ is its corresponding signature) that you haven't seen before or that you haven't received from the oracle (ie any ressources you're allowed to use). As you can see, there's nothing that would require for randomness in this definition and as such there are fully deterministic schemes with "provable" security, such as RSA-FDH.
