2
$\begingroup$

If a message is padded with cryptographically secure random bytes, is there any reason why this would be less secure than the standard signature padding schemes (PKCS1 v1.5 and PSS)? To give context to the meaning of the word "secure," I would note that my only intention is to prevent others from being able to forge the message signature.

$\endgroup$
3
  • $\begingroup$ You might want to look at this again: "...prevent others from being able to ENCRYPT the message." Perhaps you meant "decrypt." $\endgroup$
    – Patriot
    Feb 6 at 1:56
  • $\begingroup$ Given that you mention PSS, and it's a signature padding, I modified your question to be specific about it. $\endgroup$
    – DannyNiu
    Feb 6 at 2:27
  • 1
    $\begingroup$ The title of the question ask "Is it ever OK to sign RSA messages with padding random bytes", and the answer to that is yes. The body of the question in effect asks Is it always OK to sign RSA messages with padding random bytes, and the answer to that is no. I wish the question is clarified. $\endgroup$
    – fgrieu
    Feb 9 at 8:37
3
$\begingroup$

The correctness of the padding should be verifiable from the hash of the message - that is, given the hash of the message, the same padding should be reproducible. Otherwise, "existential forgery" would be possible.

So what is "existential forgery"?

Basically, you just produce a random string of bytes as your signature. When it's interpreted as an integer and raised to e'th power mod n, the lower 256/384/512 bits will be as valid a hash value as any other, so even though we don't know what message produces such hash value, we've found one that exists, hence "existential forgery".

To actually make the attack work requires some extra effort, including but not limited to:

  • mounting collision attack on the hash function against the verification exponent with many random messages.

  • for small modulus, GNFS may yield results with part of lower-order bits matching the candidate message digests.

As noted by @fgrieu in the comment, the question asks a hypothetical situation that cannot be universally applied, thereby making it a false proposition.

$\endgroup$
8
  • $\begingroup$ Doesn't existential forgery require the message $m'$? $\endgroup$
    – kelalaka
    Feb 6 at 10:22
  • $\begingroup$ @kelalaka My understanding of EF is that, the forged signature only has to be valid for some message that exists, that message doesn't have to be known. $\endgroup$
    – DannyNiu
    Feb 6 at 13:12
  • $\begingroup$ The game requires the message itself What do the signature security abbreviations like EUF-CMA mean? $\endgroup$
    – kelalaka
    Feb 6 at 13:15
  • $\begingroup$ @kelalaka But a break of the cryptosystem doesn't. $\endgroup$
    – DannyNiu
    Feb 6 at 13:34
  • $\begingroup$ The question is about forgeries, if we can forge then the signature scheme is broken, not necessarily mean that we solve the RSA-problem. $\endgroup$
    – kelalaka
    Feb 6 at 13:55
2
$\begingroup$

Let's begin with digital signatures;

Digital Signature

A digital signature scheme is simple the triple $Gen, Sign, Verify$ of polynomial-time algorithms. We want the $Gen$ and $Sign$ probabilistic and $Verify$ deterministic. The $Gen$ outputs public key $K_{pub}$ and private key $K_{prv}$

To sign a message $m$ compute $$\sigma = Sign^R(K_{prv}, m)$$ and output $(m,\sigma)$. To verify a signature compute $$\{0,1\} = Verify(K_{pub},m, \sigma)$$ and output $1$ or $0$ as signature is valid or invalid, respectively.

Since the first true signature scheme (Rabin Signature Scheme) we hash the message before the sign and this is required for the security also enables signing long messages. The hash function needs to be a collision-resistant one. Then we have;

$$\sigma = Sign^R(K_{prv}, H, m)$$ and

$$\{0,1\} = Verify(K_{pub},H, m, \sigma)$$

There are various security levels of digital signatures, here we look at the weakest adversarial goal on the signature forgeries;

Existential Forgery:

An adversary $\mathcal{A}$ creates any message/signature pair $(m,\sigma)$, where $m$ is not signed before the legitimate user. The $m$ need not have any meaning, the $\mathcal{A}$ doesn't need to control over the message $m$.

This is the weakest goal of the adversary then this implies that the strongest scheme is those which are secure against existential forgery.

As an example consider the standard text-book RSA signature. Consider two signature an attacker intercepts; $\sigma_1 = m_1^e \bmod N$ and $\sigma_2 = m_2^e \bmod n$ then $\sigma = \sigma_1 \cdot \sigma_2$ will be a valid signature for the message $m_1 \cdot m_2$. This attack uses the multiplicative property of the RSA function.

RSA-Full-Domain-Hash (bonus)

RSA-FDH is introduced by Mihir Bellare and Phillip Rogaway in 1993

This requires a hash function $H_{FDH}:\{0,1\}^* \to \mathbb{Z}_N^*$ ( first $*$ is the Klein star and the second one is the multiplicative group $\mathbb{Z}_N -\{0\}$.) It was not easy to produce a hash function during 1996, however, today we have XoF's like SHAKE128 that can produce arbitrary size.

The signature is

\begin{array}{ll} SignFDH_{N,d}(M) & & & &&&&&\\ \quad\quad y \leftarrow H_{FDH}(M)\\ \quad\quad \textbf{return } \sigma = y^d \bmod n\\ \end{array}

The signature verification is

\begin{array}{l} VerifyFDH_{N,e}(M,\sigma) &\\ \quad\quad y \leftarrow \sigma^e \bmod N&\\ \quad\quad y \leftarrow H_{FDH}(M)&\\ \quad\quad \textbf{if } y = y' \textbf{ then return } 1 \textbf{ else return } 0\\ \end{array}

As we can see the attacker needs to produce the message, not the hash of the message to produce a forgery. The verification is performed on the Message, not on the hash of the message!

Now it proven to be is existentially unforgeable under adaptive chosen-message attacks) in the random oracle model.

PKCS1-v1_5 Signature Scheme (Related)

Also known as RSASSA-PKCS1-v1_5 and its security is finally is given

It has an $EM$ structure as this

EM = 0x00 || 0x01 || PS || 0x00 || T.

so what are they;

  • PS is FFs block
  • T is the H(M) and the hash algorithm identifier
  • the first 0x00 guarantees that EM is less than the modulus.
  • The rest details like the size of FF block etc. can be found in rfc 8017 section 9.2

Turn back to OPs question

Is it ever OK to sign RSA messages with padding random bytes? If a message is padded with cryptographically secure random bytes, is there any reason why this would be less secure than the standard signature padding schemes (PKCS1 v1.5 and PSS)?

The message is hashed with a secure hash function ( say SHA-512), since it is not full domain hashing you fill the rest with random bytes. In this case, it is very similar to PKCS1-v1_5 Signature Scheme. Except you did not put the boundary blocks 00 and 01 and replaced them all with random bytes and the missing hash function id.

  • Can a random text that has taken the $e$-th power be a signature forgery?

    No, The forger needs to provide the message $m'$ too. During verification, the hash of the message $SHA-512(m')$ will be taken and compared with the one in the signature.

So what is the advantage of the $EM$ structure? It has additional verification of the format and the used hash function is encoded.

Conclusion: stick to formats, they have a long time evaluations due to security concerns.

$\endgroup$
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.