Certificate == signed public key

Question

For primes p and q used to create a keypair, I understand that the following operation is used to create a signature:

$M^d (\bmod\ N)$

where d and N have their usual meanings and M is the message. In this case, however you need to possess the public key in order to verify the signature S as follows :-

$S^e (\bmod\ N)$

In the case of a certificate (CA signed or self signed), is the plaintext public key part of it?

Answer 1

To sign a message $M$ under RSA, one should NOT build the signature as $\mathcal{Sign}(M)=M^d\bmod N$, for several reasons:

• either that limits to messages $M$ in range $[0..N-1]$, or that allows forgeries of the form $\hat M=M+k\cdot N$, because $\mathcal{Sign}(\hat M)=\mathcal{Sign}(M)$;
• that allows forgeries of the form $\hat M=R^e\cdot\prod{M_j}^{a_j}$ because $\mathcal{Sign}(\hat M)=R\cdot\prod{\mathcal{Sign}(M_j)}^{a_j}\bmod N$.

For some safe ways to use RSA to build signatures, see PKCS#1 or ISO/IEC 9796-2 (the first signs short messages only, therefore it is customary to use it to sign a hash of a message, rather than the message; the second always use a hash).

---

Public key certificates are signed messages including a public key, and additional informations usually including the identity of the legitimate holder of the corresponding private key, the identity or/and reference of the signer, the rights of the holder of the private key...