# Can I use signature(hash(message)) instead of signature(message)?

Background:

We use the TweetNaCl crypto library by Bernstein (tweetnacl.cr.yp.to) et al and we would like to stick to it. However, we have the need to sign large messages and the library does not explicitely support signing something that does not fit in a buffer of bytes. However, the 25 functions of TweetNaCl include the ability to hash (SHA-512) a message in pieces without the need to buffer for the whole message.

We consider:

So, we consider using s2 instead of s1 as defined below.

s1 = Ed25519Signature(message)
s2 = Ed25519Signature(Sha512(message))

The Ed25519Signature is computed with the TweetNaCl function:
"sm = crypto_sign(m,sk);"


Can we do this? Is s2 as secure as s1?

Edit 1: note that the "Ed25519Signature" function above is "crypto_sign" from TweetNaCl. It does hashing internally. So, the signature is computed by hashing already. The s2 approach hashes the message twice while the s1 approach does the hashing once.

• Note that in general the signature should always include a hash, so the hashing is generally included in the signature algorithm. You may be doing $\operatorname{ECSign}(H(H(M)))$ instead of $\operatorname{ECSign}(H(M))$ – Maarten Bodewes Apr 14 '18 at 20:21