Is there a risk when publishing multiple signatures for the same message? For instance, an ECDSA key (using an EC key) and a RSA-PSS signature (using a RSA key).

The context of my question is the use of Web Crypto Javascript library, where the only signature algo implemented by Edge is RSA-PKCS1 (which is not the latest recommended algo).

I was thinking of producing multiple signatures using different algo/keys and let the client check the one it wants.


Is there a risk when publishing multiple signature for the same message ?

As long as the keys are independently generated, there's no risk. This simply follows from the fact that every forgery on the composite scheme - the message signed with $n$ different keys / signature schemes - immediately implies a forgery against at least one of underlying signature schemes. But because we assume these underlying ones to all be secure, the composite scheme is secure as well. And yes, RSA-PKCSv1.5 is also secure.

What risks are there if the signatures are made with the same key?

If you re-use keys with different signature schemes, e.g. use the same key for RSA-PKCS and RSA-PSS, all bets are off by default in standard cryptographic security models and careful analysis is required to regain security statements. Examples of this include the standalones-secure CBC-MAC (a PRF for inputs which are not prefixes of each other) and OCB2 which used two related primitives with the same key in an insecure way. Without naming concrete schemes to be paired, a general statement is impossible - if they can even reuse the keys which is e.g. impossible for ECDSA and RSA-PSS as one uses a point on a curve as the public key and the other a ring with an exponent.

However, providing two signatures lets say PKCS1/[SHA]256 and another PKCS1/SHA512 using the same private key, that would not be advisable. Right ?

This would be fine if PKCS1v1.5 signatures were secure for plaintexts without hashing, so a plain signature of 0x05 instead of hashing first would be secure. But this is not the case for PKCS1v1.5. So by default it's indeed not advisable to do this. If you really have to do it though, it could be fine on the grounds that random functions (SHA256 / SHA512) are practically unrelated in their I/O behavior.

| improve this answer | |
  • $\begingroup$ What risks are there if the signatures are made with the same key? $\endgroup$ – Gilles 'SO- stop being evil' Aug 9 '19 at 21:18
  • $\begingroup$ Thanks, so if one was to own two RSA key pairs, it would not be a disaster to provide one RSA-PSS and one RSA-PKCSv1.5 signature, each using another pair... However, providing two signatures lets say PKCS1/SH256 and another PKCS1/SHA512 using the same private key, that would not be advisable. Right ? $\endgroup$ – Etienne Aug 10 '19 at 11:32
  • $\begingroup$ @Gilles if the message is identical in both cases, then not much. You'll reproduce the original signature. But if something is different? Worst case you get the PS3 firmware ECDSA signing key leak where reused secret randomness leaks the private key. $\endgroup$ – Natanael Aug 11 '19 at 0:16
  • $\begingroup$ @Etienne might be, might not be. Sometimes it is secure, sometimes it isn't, and it all depends on exactly which assumptions each scheme and implementation involved are relying on. When the assumptions contradict you may get a security flaw, called a cross protocol attack. This may cause anything from easy forgeries (oracle attacks, replay / relay attacks) to private key leakage. The default recommendation is to not reuse keys across different protocols / standards. $\endgroup$ – Natanael Aug 11 '19 at 0:17
  • $\begingroup$ @Natanael Many signature schemes (e.g. ECDSA, RSA-PSS) are non-deterministic. There's nothing wrong with signing the same message multiple times with any decent scheme such as ECDSA, deterministic ECDSA, RSA-PSS or RSA-PKCS1v1.5, except of course that with deterministic schemes it reveals that the messages are identical. The problem with PS3 is not signing the same message multiple times, it's an implementation bug that is exploitable with two different signatures using the same nonce, which doesn't require the messages to be identical. $\endgroup$ – Gilles 'SO- stop being evil' Aug 11 '19 at 8:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.