11
$\begingroup$

Background:

We use the TweetNaCl crypto library by Bernstein (tweetnacl.cr.yp.to) et al and we would like to stick to it. However, we have the need to sign large messages and the library does not explicitely support signing something that does not fit in a buffer of bytes. However, the 25 functions of TweetNaCl include the ability to hash (SHA-512) a message in pieces without the need to buffer for the whole message.

We consider:

So, we consider using s2 instead of s1 as defined below.

s1 = Ed25519Signature(message)
s2 = Ed25519Signature(Sha512(message)) 

The Ed25519Signature is computed with the TweetNaCl function:
"sm = crypto_sign(m,sk);"

Can we do this? Is s2 as secure as s1?

Edit 1: note that the "Ed25519Signature" function above is "crypto_sign" from TweetNaCl. It does hashing internally. So, the signature is computed by hashing already. The s2 approach hashes the message twice while the s1 approach does the hashing once.

|improve this question
$\endgroup$
11
$\begingroup$

Yes, this should be secure.

I am not familiar with TweetNaCl, so I cannot speak on the concrete implementation. However, the general construction of signing a hash of a message instead of the message should be secure. It is in fact a standard way to sign messages.

In general it should work for any secure signature scheme and cryptographic hash function. The intuition goes like this: assuming the signature scheme is secure, the only way to pass a signature on a message off as a signature of some different message is to find a new message with the same hash as the original message. Thus finding such a message would break 2nd preimage resistance of the hash function.

|improve this answer
$\endgroup$
  • 10
    $\begingroup$ One caveat. The hashing step should be used for all signed messages, not only long messages. If you only hash long messages before signing, then that signature will also be valid for a short message consisting of just the hash value, which may be interpreted in an unintended way. $\endgroup$ – kasperd Apr 17 '17 at 14:18
  • 3
    $\begingroup$ Good point, I suppose I should just have said "it is a standard way of signing messages". $\endgroup$ – Guut Boy Apr 17 '17 at 14:21
  • 2
    $\begingroup$ This is not just standard, it's the only way to go for secure signature schemes based on an asymmetric cipher primitive (RSA, ECDSA, etc), because you can only sign a fixed-length message with such schemes. $\endgroup$ – zwol Apr 18 '17 at 1:33
  • $\begingroup$ @zwol well, you could still sign unhashed messages if their size match the fixed length. $\endgroup$ – Guut Boy Jul 28 '17 at 17:42
  • $\begingroup$ Note that in general the signature should always include a hash, so the hashing is generally included in the signature algorithm. You may be doing $\operatorname{ECSign}(H(H(M)))$ instead of $\operatorname{ECSign}(H(M))$ $\endgroup$ – Maarten Bodewes♦ Apr 14 '18 at 20:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.