I cite from Fundamentals of Computer Security (Chapter 7 on Digital Signature, Paragraph 7.3 on RSA Signatures, page 289):

Multiple uses of the RSA Signature scheme tend to weaken it. The way out is to make subsequent signatures dependent on those previously generated.

  • Why is this?
  • Does it affect also the RSA Encryption scheme, or is it a weakness that comes from the knowledge of the message (and therefore affects only Signature schemes)?

It's hard to say from that out-of-context statement. It may be that they were talking about signatures with obsolete padding schemes (such as ISO 9796-1), or possibly just raw RSA (zero padding, which is even worse); it is possible with these padding, if you observe enough signatures, you could come up with a forgery.

On the other hand, there is no known weakness if you generate RSA signatures using a modern padding scheme, either PKCS #1.5 (which, I suppose, is a bit hard to call modern) or PSS.

  • $\begingroup$ Yeah, it was a kick in my eyes when I read that statement with no context!That's why I posted here, I just hadn't got any idea of what to search for...thks anyway, and I hope someone knows what's the point in it... $\endgroup$ – Matteo Jun 19 '12 at 19:59
  • 1
    $\begingroup$ @Matteo: in addition, there's the suggestion "the way out is to make subsequent signatures dependent on those previously generated"; I cannot come up with any context where that makes sense. If they drop in statements like that without saying what they mean, well, I would start questioning the expertise of the authors. $\endgroup$ – poncho Jun 19 '12 at 20:12
  • $\begingroup$ The subsequent suggestion is followed by the description of an algorithm proposed by Cramer and Damgard. However they discuss the algorithm without explaining why multiple use causes the scheme to be weakened. $\endgroup$ – Matteo Jun 19 '12 at 20:17

Your Answer

