Suppose that we have an EU-CMA or sEU-CMA signature scheme without random oracles. My question is if messages to be signed are in the form H(m), where H is a hash function (doesn't belong to the signature parameters). Does this affect the security of the scheme?

EU-CMA: existentially unforgeable under chosen message attack.

sEU-CMA: Strongly EU-CMA.

See digital signature forgery for more info.


If the hash function is collision-resistant, it doesn't affect security.

Another way to put it: it affects security, in the sense that you are now reliant upon the security of the hash function to resist collisions. But if it is infeasible to find collisions in the hash function, and if the underlying signature scheme is secure, then signing a hash of the message is also secure.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.