Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

During my master thesis I came across RSA-PSS-R which is in my opinion a quite elegant way of saving bandwidth and space using digital signature. But I didn't find any information about any real world implementation out there. I have the feeling that it's exactly like the Schnorr Signature scheme. Everybody says that it is very efficient, but no one actually uses it.

Maybe I didn't dig deep enough but is there anyone out there actually using message recovery AT ALL in any real world implementation?

Thank you for your feedback

share|improve this question
My guess is that since in real world one uses the "hash then sign" paradigm (i.e., hash a message and sign the hash value) a signature scheme with message recovery does not really give an added value, since you can only recover the hash value (which, due to the one-wayness of the hash function will not let you recover the message itself). – DrLecter Nov 14 '13 at 15:29
@DrLecter Even when using a hash as part of the signature one could put the (beginning of the) message into the remaining space. – CodesInChaos Nov 14 '13 at 17:18
@CodesInChaos yes thats true. Actually I did not think of very small message spaces :/ Clearly, in authentication protocols and resource constraint environments that feature could actually make sense. Didn't think of that either :) – DrLecter Nov 14 '13 at 17:29

A signature scheme with message recovery is standardized as ISO/IEC 9796-2 (link to preview). Scheme 1 in this standard is commonly used in the Smart Card industry, despite its known weaknesses in a chosen-message setup.

Example real-life uses include the EMV banking application (the free documents linked there include a description of an industry-standard subset of ISO/IEC 9796-2 Scheme 1; there is support for this subset in JavaCard 2.2.2 and up); and the certificates in the European Digital Tachograph system (head to Annex 1B, appendix 11).

Update: As kindly pointed by owlstead, that is also used in ICAO e-passport specifications, appendix 4.

share|improve this answer
Not to mention ICAO specifications for passports which use it in the Active Authentication protocol - although for that it is only used within a challenge response protocol (the challenge is recovered). Tacho also uses it for certificates, if I'm not mistaken. – Maarten Bodewes Nov 14 '13 at 16:49
I will have a look at it. Thx for the advice – Olivier Bantou Nov 15 '13 at 14:53

Some implementations of RSA PKCS#1v1.5 use message recovery to find out which hash function was applied.

PKCS#11 API defines the C_SignRecover and C_VerifyRecover and allow them to be used with the most RSA mechanisms. Long story short: this means that there is very widely available API which allows the functionality. Thus, it is likely that quite a few pieces of software use it in practice.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.