[3767] in cryptography@c2.net mail archive
Re: Recovering message from signature
daemon@ATHENA.MIT.EDU (EKR)
Wed Dec 9 10:34:42 1998
To: staym@accessdata.com
Cc: cryptography@c2.net
From: EKR <ekr@rtfm.com>
Date: 09 Dec 1998 07:12:39 -0800
In-Reply-To: staym@accessdata.com's message of "Tue, 08 Dec 1998 16:36:13 -0700"
staym@accessdata.com writes:
> I seem to recall hearing of a signature scheme wherein the message is
> recovered from the signature. Does this ring a bell for anyone? Any
> pointers?
Signature schemes are usually divided into schemes that provide
"message recovery" (like RSA), and schemes that don't (like DSA).
"message recovery" schemes let you use the signature to get the
digest that was input to the signature.
That said, Mihir Bellare has proposed an optimal signature
construct (that is a pair to OAEP) that allows you to hide
some of the message in the signature. (IIRC, something like
keysize - 36 bytes). That may be what you're thinking of.
I don't know of any scheme that will let you recover
arbitrary size messages using the signature. Obviously,
such a scheme would require a signature as large as the
message.
-Ekr
--
[Eric Rescorla ekr@rtfm.com]
