The RMX Transform and Digital Signatures∗

This document describes RMX, a simple message randomization scheme that when used as a front end to existing hash-then-sign signature schemes, such as RSA and DSS, frees these signatures from their current vulnerability to off-line collision attacks on the underlying hash function. We demonstrate the practicality of the approach, which requires no change to hash functions or signature algorithms, by describing how to accomodate RMX in the context of actual applications (e.g., certificate signing, XML signatures) and existing implementations (e.g., openssl). In many cases, the required changes are only slightly more complex than accomodating a new (deterministic) hash function. ∗See http://www.ee.technion.ac.il/~hugo/rhash/ for updates. †Email: [email protected]. ‡Email: [email protected]