Signature Scheme with proof of data possession Most signature schemes first hash the data and than sign the hash. Correct me if I am wrong: The signature does not prove that the signatory was in possession of the document itself? In cases where the document hash but not the document itself is public, anyone could create a signature for the document without having access to the document data itself. Is there any well known signature scheme that gives a proof of data possession?

I am interested on any hints to existing signature schemes that provide proof of data possession at time of signature creations.

My question is if there are any existing well known/reviewed signature schemes that provide proof of data possession. I am not asking how to "roll your own".
If the document is short enough, then its ISO/IEC&nbsp;9796-2 signature proves data possession, for a simple reason: in so-called total recovery mode, signature verification recovers the document as a byproduct.

ISO/IEC&nbsp;9796-2 is an RSA or Rabin signature scheme, also requiring a hash. Depending on options, the "recoverable" message (that is, embedded in the signature) can be up to about $n-h-16$ bits, for $n$-bit public modulus and $h$-bit hash. For example, with 4096-bit RSA and SHA-256, the message can be up to 478-octet, embedded in a 512-octet signature.

ISO/IEC&nbsp;9796-2 mode 1 is in wide use in Smart Cards. However, beware that it has a near-practical weakness allowing forgery from the signature of chosen messages. ISO/IEC 9796-2 mode 3 is functionally compatible with mode 1, and cures that. Both are deterministic, and maximize the size of the embedded message. ISO/IEC 9796-2 mode 2 is randomized, like RSASSA-PSS, which allows a stronger security argument, at the expense of reducing maximum message size for total recovery.



Independently: for any signature scheme with appendix signing a hash, including RSASSA-PSS and (EC)DSA, changing $\mathcal S_\text{priv}(\operatorname H(M))$ to $$\mathcal S_\text{priv}(\operatorname H(M))\|\mathcal S_\text{priv}(\operatorname{HMAC-H}(\mathcal S_\text{priv}(\operatorname H(M)),M))$$proves possession of $M$ as well as a static signature can do. That has the advantage of working with large messages. This is not standardized, but is a straightforward combination of standardized things.

Addition per comment: this is out of my head. However, the security argument (not proof) is simple:


$\operatorname{HMAC-H}$ is a standard Message Authentication Code construction from a hash.
A standard single-pass interactive proof of data possession is using $\operatorname{MAC}(R,M)$ where $R$ is a random challenge used as key of the MAC.
Signing that gives insurance that the signer is involved.
Replacing $R$ with the signature of the hash makes it non-interactive and invoking the signer before the HMAC could be computed, yet verifiable.


Still, a dishonest signer can offload all hashing to a third party, but that seems inevitable. And an imprudent signer hashing-and-signing any message can be abused into signing a proof of possession of something s/he did not keep (because HMAC's result is a hash).

Note: I chose this, at the price of requiring two signatures, rather than
$$\mathcal S_\text{priv}(\operatorname H(M))\|\operatorname{HMAC-H}(\mathcal S_\text{priv}(\operatorname H(M)),M)$$
because:


The security argument of the former is more straightforward.
The later succumbs if $H$ turns out not to be collision-resistant: an attacker could find $M$ and $M'$ with $H(M)=H(M')$, give $M'$ to signer, obtain $\mathcal S_\text{priv}(\operatorname H(M'))$ as part of proof of possession of $M'$ by honest signer, and turn that into a (different) forged proof of possession of $M$, when the honest signer never knew that $M$.
Involving the signer at beginning and end of preparation of the proof of possession arguably makes repudiation harder.