I'm trying to verify that a smartcard (possibly doctored by an attacker) has access to the (ECDSA P-384) private key for which I was given a (signed) public key, in order to verify that the card is genuine. In order to do that, I should pass a random nonce to the card, ask it to sign it, and verify the result against the trusted public key.
I know that best practice for signing something with public/private keypairs is to hash the nonce and sign the hash, rather than signing the data directly, mostly because signing a long document with a private key would take a large amount of signing operations, which is not good for performance. However, since I'm not signing a document but just a small nonce, I can control the size of the nonce to have exactly the size of what the hash would be, and bypass the hashing operation. When trying to verify the result using OpenSSL's EVP_DigestVerify* methods, however, I see that it expects me to pass the hashing algorithm that was used for the signature, but since I just sent random bytes of the correct length, I don't really have one. I found EVP_md_null(), but its documentation says
A "null" message digest that does nothing: i.e. the hash it returns is of zero length.
which is not what I was looking for (I would need a function that passes the input unmodified as the output).
Two questions:
- Is this a bad idea for some reason that I don't know about? e.g., is there an important security property that I lose if I do things this way?
- If not, how can I tell OpenSSL with the
EVP_*functions that I just want signature verification, and that I don't want a hashing operation of the input data?
