Struct PrehashedDataToSign 

pub struct PrehashedDataToSign<E: Curve>(/* private fields */);

A pre-hashed message digest intended for signing, where the original message (preimage) may be unknown.

This struct wraps a scalar value representing a message digest. Unlike its safer counterpart, DataToSign, this struct can be constructed directly from a raw scalar, bypassing the safety check that ensures the original message is known.

Context: PrehashedDataToSign vs. DataToSign

This library provides two types for data to be signed:

• DataToSign (Recommended): This is the safe, default option. Its API requires you to provide the original message bytes. The library then handles the hashing internally. This acts as a type-safe guard, guaranteeing that the signature corresponds to a known message.
• PrehashedDataToSign (Advanced): This is a low-level type for specific, advanced use cases. It contains a hash that was computed externally.

This PrehashedDataToSign struct is only accepted by library functions where it is safe to do so—specifically, in the full interactive signing protocol where the forgery attacks described below are not applicable.

⚠️ Assume Preimage Known: Advanced Use Only

This library offers a feature flag named insecure-assume-preimage-known for highly specialized use cases. When enabled, this feature exposes the method PrehashedDataToSign::insecure_assume_preimage_known which allows you to convert a PrehashedDataToSign directly into a DataToSign. This is a powerful but extremely dangerous operation. It overrides the library’s type safety, telling the system to trust that a known original message exists for the given hash, even if one does not.

This feature completely bypasses the security guarantees provided by the DataToSign type and should almost never be used.

Potential Attack: Signature Forgery via Raw Hash Signing

This attack, detailed in this paper (Section 1.1.2, “An attack on ECDSA with presignatures”), enables signature forgery when a system signs raw hashes in combination with presignatures.

The core idea is that an attacker can forge a signature for a message of their choice, m', by tricking the system into signing a different, maliciously crafted hash, h.

Here’s a simplified breakdown of how it works:

• Message Selection: The attacker first chooses a target message, m', that they want a forged signature for
• Malicious Hash Construction: Instead of submitting h' = H(m'), the attacker uses the hash of their target message, H(m'), and public data from the presignature to compute a new, malicious hash value, h. This h has no known preimage and appears random.
• Signing Request: The attacker submits this raw hash h to the signing protocol.
• Forgery: The protocol signs h and returns a signature component. The attacker then uses this component to mathematically compute the final, valid signature for their original target message, m'.

Essentially, the attacker exploits the signing algorithm’s structure. By carefully crafting the hash input, they can predict and manipulate the output to forge a signature for an entirely different message. This is why signing a hash without knowing its original message (preimage) is extremely dangerous in this context.

Implementations

impl<E: Curve> PrehashedDataToSign<E>

pub fn from_scalar(scalar: Scalar<E>) -> Self

Constructs a PrehashedDataToSign from scalar

scalar must be output of cryptographic hash function applied to original message to be signed

pub fn to_scalar(self) -> Scalar<E>

Returns a scalar that represents a data to be signed

pub fn insecure_assume_preimage_known(self) -> DataToSign<E>

Available on crate feature insecure-assume-preimage-known only.

Converts a PrehashedDataToSign directly into a DataToSign

⚠️ Extremely dangerous operation. It overrides the library’s type safety, telling the system to trust that a known original message exists for the given hash, even if one does not. Read PrehashedDataToSign docs to learn why it’s dangerous.

It’s only safe to use this method if you have either:

1. Hashed the original message yourself to generate this scalar (prefer directly using DataToSign when possible).
2. Can otherwise completely verify and trust the source of the prehashed data.

Trait Implementations

impl<E: Curve> AnyDataToSign<E> for PrehashedDataToSign<E>

fn to_scalar(&self) -> Scalar<E>

Returns a scalar that represents a data to be signed

impl<E: Clone + Curve> Clone for PrehashedDataToSign<E>

fn clone(&self) -> PrehashedDataToSign<E>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<E: Debug + Curve> Debug for PrehashedDataToSign<E>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<E: Copy + Curve> Copy for PrehashedDataToSign<E>