2

When I sign a message (which has potentialy low entropy) using a private key and I send it without the original message, can the original message be retrieved from the signature(s)?

I want to prove – over an unsecure channel – that I know a secret password without revealing it.

Could a man-in-the-middle (who does not know the original message) create a signature using a different private key which would look like he knew the original message? That would give him the oppertunity to claim to also know the message without really knowing it.

e-sushi
  • 17,891
  • 12
  • 83
  • 229
Nathan
  • 181
  • 1
  • 6

1 Answers1

2

When I sign a message (which has potentialy low entropy) using a private key and i send it without the original message, can the original message be retrieved from the Signaturen?

It depends.
If you use a signature scheme with appendix it will be impossible to recover the message using other ways than brute-force (so the answer would be "yes" for low-entropy). This is the usual case for most signature schemes (like RSASSA-PSS and ECDSA). If you use a signature scheme with message recovery (quite rare, like ISO/IEC 9796-2) you can indeed recover the message.

I want to prove over an unsecure channel that i know a secret password without revealing it

I suggest you give SRP a try for this.
It's specifically designed to combine password authentication with key-agreement (and thereby prove of knowledge of password).

Could a man in the middle who does not know the original message create a signature using a different private key which would look like he knew the original message?

A signer needs to know the message in order to be able to sign it. If you can create a signature that is valid without letting the signer ever see the message, you have successfully broken the standard definition of security for this scheme.

Community
  • 1
SEJPM
  • 45,967
  • 7
  • 99
  • 205