# Could we use a more efficient hash for signature generation?

Is it possible to use a more efficient hash - such as one based on GHASH - instead of a cryptographic hash for signature generation?

In other words, could a combination of a fast hash and the private key operation together provide the security that we expect from a cryptographic hash? Could such a scheme be proven to be secure assuming that the underlying primitives are secure?

• Schnorr-based signature schemes like EdDSA famously "only" require target-collision resistance instead of full collision resistance. Now the question is of course whether you would actually trust a hash function which fails to provide full collision resistance but claims to have target-collision resistance... – SEJPM Oct 20 '18 at 18:26
• And of course if your message is really short hash-based signature schemes famously only require one-way-ness of the hash function. – SEJPM Oct 20 '18 at 18:32
• Ah, "target-collision resistance". That sounds like a good term to Google. Hopefully I won't just score insightful comments but also answers of course. I'm already glad I asked :) – Maarten Bodewes Oct 20 '18 at 18:36
• GHash is not second pre-image resistant and thus unsuitable – CodesInChaos Oct 20 '18 at 19:15
• This PDF-paper by Neven, Smart and Warinschi explicitly lists the requirements on the hash function in section 4. It appears that the answer is "it's complicated" and in fact so complicated that I won't answer (for now). – SEJPM Oct 20 '18 at 19:24

For Fiat-Shamir based constructions like (EC)DSA things are not that easy as you cannot just "additionally" sign the index. What you can do however is to reuse the random nonce (think of $$g^r$$ in Schnorr) as index as pointed out by Mironov in this paper. Actually, that paper discusses a lot of the things I just wrote in more detail.