2
$\begingroup$

Let's say my public key is defined as $P = p \cdot G$, where $p$ is my private key and $G$ is a generator point of an elliptic curve. If I wanted to sign a message $m$, could I do the following?

  1. Hash $m$ to a number using a hash function: $h = Hash(m)$.
  2. Compute signature as $S = \frac{p}{h} \cdot G$.

The verification of the signature can then be done by checking that $P = Hash(m) \cdot S$.

This seems like it should work - but also seems too simple - so, I'm wondering if there is anything I'm missing here.

$\endgroup$
  • $\begingroup$ $1/h$ is a scalar division in the prime finite field $\mathbb{F}_q$. So $1/h = a$ where $a$ is Bezout's coefficient ($a.h+b.q=1$). $\endgroup$ – Youssef El Housni Dec 17 '18 at 10:21
2
$\begingroup$

This signature scheme doesn't even provide UF-KOA security.

The attack is simple: When you want to forge a signature for a message $m$, given a public key $P$, simply compute $h=H(m), h'=h^{-1}\bmod q$ and $S=h'\cdot P$, with $q$ being the order of the subgroup generated by $G$ (usually the curve order). $S$ is then your forged signature for $m$.

This works as:

$\endgroup$

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.