<p>If the hash function is collision-resistant, it doesn't affect security.</p>

<p>Another way to put it: it affects security, in the sense that you are now reliant upon the security of the hash function to resist collisions.  But if it is infeasible to find collisions in the hash function, and if the underlying signature scheme is secure, then signing a hash of the message is also secure.</p>

CC BY-SA 3.0
2011-05-11T08:39:32.517Z
2011-05-11T08:39:32.517Z
D.W.
<p>Suppose that we have an EU-CMA or sEU-CMA signature scheme without <a href="http://en.wikipedia.org/wiki/Random_oracle" rel="nofollow">random oracles</a>. My question is if messages to be signed are in the form H(m), where H is a hash function (doesn't belong to the signature parameters). Does this affect the security of the scheme?</p>

<p><strong>EU-CMA:</strong> existentially unforgeable under chosen message attack.</p>

<p><strong>sEU-CMA:</strong> Strongly EU-CMA.</p>

<p>See <a href="http://en.wikipedia.org/wiki/Digital_signature_forgery" rel="nofollow">digital signature forgery</a> for more info.</p>

CC BY-SA 3.0
2011-04-30T02:01:09.380Z
Are you asking whether the only possible way is the so-called **hash-and-sign** mechanism?
Sadeq Dousti
CC BY-SA 3.0
2011-05-03T09:16:39.730Z
in some way this is what i meant.
sam
CC BY-SA 3.0
2011-05-03T11:59:08.213Z
This might be useful: [A Practical and Tightly Secure Signature Scheme Without Hash Function](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.104.6168&rep=rep1&type=pdf). If not, please be more specific about what you want.
Sadeq Dousti
<cr.crypto-security>
signature scheme without random oracles
sam
# signature scheme without random oracles

(Asked by: username_0 on 2011-04-29)

Suppose that we have an EU-CMA or sEU-CMA signature scheme without [random oracles](http://en.wikipedia.org/wiki/Random_oracle). My question is if messages to be signed are in the form H(m), where H is a hash function (doesn't belong to the signature parameters). Does this affect the security of the scheme?

**EU-CMA:** existentially unforgeable under chosen message attack.

**sEU-CMA:** Strongly EU-CMA.

See [digital signature forgery](http://en.wikipedia.org/wiki/Digital_signature_forgery) for more info.

**Tags:** cr.crypto-security

> **Comments:**
> **username_1**: Are you asking whether the only possible way is the so-called **hash-and-sign** mechanism?  
> **username_0**: in some way this is what i meant.  
> **username_1**: This might be useful: [A Practical and Tightly Secure Signature Scheme Without Hash Function](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.104.6168&rep=rep1&type=pdf). If not, please be more specific about what you want.  

---

## 1 answers

### Answer by username_2 on 2011-05-11. Score: 1

If the hash function is collision-resistant, it doesn't affect security.

Another way to put it: it affects security, in the sense that you are now reliant upon the security of the hash function to resist collisions. But if it is infeasible to find collisions in the hash function, and if the underlying signature scheme is secure, then signing a hash of the message is also secure.


---

