7
$\begingroup$

During my master thesis I came across RSA-PSS-R which is in my opinion a quite elegant way of saving bandwidth and space using digital signature. But I didn't find any information about any real world implementation out there. I have the feeling that it's exactly like the Schnorr Signature scheme. Everybody says that it is very efficient, but no one actually uses it.

Maybe I didn't dig deep enough but is there anyone out there actually using message recovery AT ALL in any real world implementation?

Thank you for your feedback

Improve this question
$\endgroup$
3
  • $\begingroup$ My guess is that since in real world one uses the "hash then sign" paradigm (i.e., hash a message and sign the hash value) a signature scheme with message recovery does not really give an added value, since you can only recover the hash value (which, due to the one-wayness of the hash function will not let you recover the message itself). $\endgroup$
    – DrLecter
    Commented Nov 14, 2013 at 15:29
  • $\begingroup$ @DrLecter Even when using a hash as part of the signature one could put the (beginning of the) message into the remaining space. $\endgroup$
    – CodesInChaos
    Commented Nov 14, 2013 at 17:18
  • $\begingroup$ @CodesInChaos yes thats true. Actually I did not think of very small message spaces :/ Clearly, in authentication protocols and resource constraint environments that feature could actually make sense. Didn't think of that either :) $\endgroup$
    – DrLecter
    Commented Nov 14, 2013 at 17:29

2 Answers 2

Reset to default
7
$\begingroup$

A signature scheme with message recovery is standardized as ISO/IEC 9796-2 (link to preview). Scheme 1 in this standard is commonly used in the Smart Card industry, despite its known weaknesses in a chosen-message setup.

Example real-life uses include the EMV banking application (the free documents linked there include a description of an industry-standard subset of ISO/IEC 9796-2 Scheme 1; there is support for this subset in JavaCard 2.2.2 and up); and the certificates in the European Digital Tachograph system (head to Annex 1B, appendix 11).

Update: As kindly pointed by Maarten Bodewes, that is also used in ICAO e-passport specifications, appendix 4.

Improve this answer
$\endgroup$
2
  • $\begingroup$ Not to mention ICAO specifications for passports which use it in the Active Authentication protocol - although for that it is only used within a challenge response protocol (the challenge is recovered). Tacho also uses it for certificates, if I'm not mistaken. $\endgroup$
    – Maarten Bodewes ♦
    Commented Nov 14, 2013 at 16:49
  • $\begingroup$ I will have a look at it. Thx for the advice $\endgroup$
    – Mr Anderson
    Commented Nov 15, 2013 at 14:53
2
$\begingroup$

Some implementations of RSA PKCS#1v1.5 use message recovery to find out which hash function was applied.

PKCS#11 API defines the C_SignRecover and C_VerifyRecover and allow them to be used with the most RSA mechanisms. Long story short: this means that there is very widely available API which allows the functionality. Thus, it is likely that quite a few pieces of software use it in practice.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.