# Signature with appendix

I see sometimes signatures schemes with appendix. This is about signatures schemes in which the message is needed in the verification algorithm, that is, the ouput of the signature algorithm is of the form $(M,s)$

The appendix is referred to the message or the signature ?

Thank you.

-
Where did you see this terminology used? –  Maeher Jun 24 '13 at 9:30
In the handbook of applied cryptography chapter 11 or in this RFC ietf.org/rfc/rfc3447.txt. –  Dingo13 Jun 24 '13 at 9:35

In a signature scheme with appendix (such as RSASSA-PSS), the signature $s=Sign(M,PrivateKey)$ of the message $M$ is usually appended to the unmodified message $M$, forming $(M,s)$. This is effectively sent, and verified; the signature is an appendix to the message.
Signature scheme with appendix opposes to signature scheme with message recovery (such as ISO/IEC 9796-2). In the later kind, all or some of the message is embedded in the signature. When all of the message is embedded, the verification procedure requires only $s=Sign(M,PrivateKey)$ as input, and recovers $M$ as a by-product (that's known as total message recovery). Only the signature is sent; it embeds the message.