3
$\begingroup$

Is my summary understanding of current (classical) Digital signature standards essentially correct? I may be totally wrong.

DSA is no longer to be used for new signature generation just for checking existing signatures.

EdDSA is to be used for new signature generation.

Question: Does this mean all (most?) current standardized digital signatures for generating new signatures are Elliptic curve based?

Any caveats, explanations, extra background appreciated.

Improve this question
$\endgroup$
2

1 Answer 1

Reset to default
6
$\begingroup$

A short answer on NIST;

With the NIST.FIPS.186-5

  • Published: February 3, 2023
  • Effective: February 3, 2023
  1. Prior versions of this standard specified the DSA. This standard no longer approves the DSA for digital signature generation. However, the DSA may be used to verify signatures generated prior to the implementation date of this standard. See FIPS 186-4 [7] for the specifications for the DSA.

  1. The RSA Digital Signature Algorithmm : still exists

  2. The Elliptic Curve Digital Signature Algorithm (ECDSA)

  3. The Edwards-Curve Digital Signature Algorithm (EdDSA)

Extra

Improve this answer
$\endgroup$
7
  • 4
    $\begingroup$ RSA still has advantages: speed and simplicity of verification, which are useful in code signing and certificates, where it is very common (certificates for EdDSA keys can be RSA-signed by a certification authority). It's justified in applications where we sign once, verify many times. It can also have low size overhead when used with message recovery, and thus ISO/IEC 9796-2 is common in Smart Cards. $\endgroup$
    – fgrieu ♦
    Commented Nov 7, 2023 at 7:46
  • 1
    $\begingroup$ For RSA and others, batch verification exists with problems. Also, deterministic ECDSA is also used in crypto currencies. $\endgroup$
    – kelalaka
    Commented Nov 7, 2023 at 9:34
  • 2
    $\begingroup$ @fgrieu researchgate.net/publication/… $\endgroup$
    – kelalaka
    Commented Nov 7, 2023 at 11:27
  • 1
    $\begingroup$ Thanks for the pointer. The RSA batch verification scheme in this article and it's Harn reference is applicable only to some RSA signatures standards that hash-then-textbook-RSA-sign (e.g. RSASSA-PKCS1-v1_5, RSA-FDH, not RSASSA-PSS), and only for multiple messages signed with the same key. This limits it's applications. When it applies, it does save some computation, appreciably so for very large $e$. $\endgroup$
    – fgrieu ♦
    Commented Nov 7, 2023 at 12:05
  • 1
    $\begingroup$ @fgrieu OK, thank you for distinguishing those. I did not look that deep and I should have. $\endgroup$
    – kelalaka
    Commented Nov 7, 2023 at 12:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.