Suppose that we have an EU-CMA or sEU-CMA signature scheme without random oracles. My question is if messages to be signed are in the form H(m), where H is a hash function (doesn't belong to the signature parameters). Does this affect the security of the scheme?

EU-CMA: existentially unforgeable under chosen message attack.

sEU-CMA: Strongly EU-CMA.

See digital signature forgery for more info.

  • 1
    $\begingroup$ Are you asking whether the only possible way is the so-called hash-and-sign mechanism? $\endgroup$ Commented Apr 30, 2011 at 2:01
  • $\begingroup$ in some way this is what i meant. $\endgroup$
    – sam
    Commented May 3, 2011 at 9:16
  • 2
    $\begingroup$ This might be useful: A Practical and Tightly Secure Signature Scheme Without Hash Function. If not, please be more specific about what you want. $\endgroup$ Commented May 3, 2011 at 11:59

1 Answer 1


If the hash function is collision-resistant, it doesn't affect security.

Another way to put it: it affects security, in the sense that you are now reliant upon the security of the hash function to resist collisions. But if it is infeasible to find collisions in the hash function, and if the underlying signature scheme is secure, then signing a hash of the message is also secure.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.