Timeline for What does "signing" a file really mean?
Current License: CC BY-SA 4.0
30 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 12, 2021 at 21:55 | history | edited | forest | CC BY-SA 4.0 |
misc changes; fixed equation
|
| Jul 9, 2019 at 13:55 | vote | accept | zgulser | ||
| Dec 15, 2018 at 22:32 | comment | added | forest | @Luc Another thing to remember is that verifying an RSA signature does not involve "recovering" the original hash. To verify, you raise the signature to the power of the public exponent and see if it is congruent to the hash of the message modulo the public modulus. That is not encryption or decryption. | |
| Dec 15, 2018 at 15:02 | comment | added | Gilles 'SO- stop being evil' | @Luc The math of ECC is a bit complicated. If you want to dig into the math, DSA uses the same signature mechanism as ECDSA over different mathematical foundations. If you want a more high-level view, I've now posted an answer to this question which doesn't dive into how signature algorithms work inside and instead explains how they are used. | |
| Dec 15, 2018 at 14:33 | comment | added | Luc | @Gilles I knew that ECC worked differently in terms of signing, but hadn't looked into it yet. Thanks for reminding me, I will do that! | |
| Dec 15, 2018 at 14:23 | comment | added | Gilles 'SO- stop being evil' | @Luc Your original understanding is still incorrect. RSA-PKCS#1v1.5 is a special kind of signature that allows recovery: you can find the hash of the message from the signature value. A signature with recovery looks superficially similar to encrypting the hash, but has different security properties. You should have a look at how other common signature schemes work, the most common one being ECDSA. ECDSA does not allow recovery and is not even superficially similar to “encrypting” with the private key. | |
| Dec 15, 2018 at 1:10 | history | edited | forest | CC BY-SA 4.0 |
forgotten word
|
| Dec 4, 2018 at 11:15 | comment | added | forest | @Luc The same trapdoor is used for signing, verification, encryption, and decryption, that is true. However, RSA as a cryptosystem is much more than just the trapdoor function (which people often forget). When you're signing something in the real world, a lot more goes on than just modular exponentiation. I'm doing nothing more than parroting the general consensus on Cryptography. | |
| Dec 4, 2018 at 11:11 | comment | added | Luc | After taking 30 minutes to carefully read the answer and linked material, I conclude that I wasted my time and my original understanding was correct: the signer encrypts with the private key and everyone else can decrypt it using the public key. It's known that RSA is super slow so we want to only do it on small messages, hence the hashing; and it's known that textbook RSA is insecure, hence the "padding". That doesn't make signing a wholly different operation: it's still raising a message to a private exponent mod N. I don't find the premise of your answer helpful to my understanding at all. | |
| Nov 28, 2018 at 6:45 | history | edited | forest | CC BY-SA 4.0 |
fixed confusing choice of words
|
| Nov 28, 2018 at 5:39 | comment | added | forest | @DavidSchwartz I used RSA as an example not only because it is extremely common, but because it is easy to understand (I am so not going to try to explain how elliptic curve signatures work). However, I linked to and quoted content which explained that algorithms based on IFP and DLP like RSA and El Gamal (or DSA) are unique in that respect to try to avoid misconceptions. Do you have any suggestions? | |
| Nov 28, 2018 at 5:37 | comment | added | forest | @HenkHolterman No, you couldn't. The size of the message itself is limited. I suppose you could break up a message into multiple chunks and sign them individually, but just like you can't encrypt a large value, you can't sign a large value. Public key encryption is quite different from symmetric encryption. | |
| Nov 27, 2018 at 21:07 | comment | added | Henk Holterman | The hash is completely optional. It is customary and an optimization but you could just sign the entire message. | |
| Nov 27, 2018 at 19:25 | comment | added | David Schwartz | @forest RSA is an extremely unusual algorithm owing to the relationship between its encryption and signature algorithms. That makes it the worst possible example algorithm you could have chosen and, by choosing it, you could easily confuse someone into thinking the unique properties of RSA are general properties of cryptosystems. That unfortunate confusion is all over the answers to this simple question, your answer does much to contribute to that confusion, and nothing to straighten it out. | |
| Nov 27, 2018 at 17:10 | comment | added | kmdreko | why is this method preferred over just encrypting the hash? what kind of problems does encrypting the hash have that this doesn't? | |
| Nov 27, 2018 at 10:53 | comment | added | HAEM | You might want to use an algorithm where signing and encryption look obviously different for your example. | |
| Nov 27, 2018 at 6:38 | comment | added | David Schwartz | @TessellatingHeckler Unfortunately, sometimes you get a lot of incorrect answers with confusing comments and even upvotes to what should be a simple question. In that case, it's very hard to produce a simple answer that explains what's wrong with the apparently simple answers. | |
| Nov 27, 2018 at 4:34 | history | edited | forest | CC BY-SA 4.0 |
added link, moved quote to top
|
| Nov 27, 2018 at 4:25 | history | edited | forest | CC BY-SA 4.0 |
edit in response to helpful feedback
|
| Nov 27, 2018 at 4:11 | comment | added | forest | @TessellatingHeckler Thank you for the feedback. I specified that it is more similar to decryption than encryption, but still not truly encryption (hence the link). I'll also edit the question to add a more simple explanation and leave the technical details as an extra. | |
| Nov 27, 2018 at 3:07 | comment | added | TessellatingHeckler | because I think it's "not useful" (by the downvote tooltip wording). I think it won't answer OP's beginner level questions, and your point isn't clearly explained or justified. In what way is the second equation closer to decryption, and why is that a relevant part to single out and focus on? Why then a link which says it isn't decryption, if you're trying to be strictly correct? Changing @Lithilion's answer to say "processes only the hash" would make it less incorrect, but simple enough to be useful to OP. | |
| Nov 27, 2018 at 2:18 | history | edited | forest | CC BY-SA 4.0 |
added 11 characters in body
|
| Nov 27, 2018 at 2:01 | history | edited | forest | CC BY-SA 4.0 |
quote from link in answer
|
| Nov 27, 2018 at 1:53 | history | edited | forest | CC BY-SA 4.0 |
grammar
|
| Nov 27, 2018 at 1:33 | history | edited | forest | CC BY-SA 4.0 |
all the fermat primes satisfy all the requirements for the public exponent
|
| Nov 27, 2018 at 1:24 | history | edited | forest | CC BY-SA 4.0 |
link to crypto.se post
|
| Nov 27, 2018 at 1:17 | history | edited | forest | CC BY-SA 4.0 |
explained what makes rsa signatures secure
|
| Nov 27, 2018 at 1:12 | history | rollback | forest |
Rollback to Revision 1
|
|
| Nov 27, 2018 at 1:05 | history | edited | forest | CC BY-SA 4.0 |
somewhat oversimplified
|
| Nov 27, 2018 at 0:44 | history | answered | forest | CC BY-SA 4.0 |