Should different key pairs be used for signing and encryption?

Question

In the recent iOS Security white paper from Apple (February 2014), the section on iMessage discusses using two different asymmetric key types as part of its standard operation:

When a user turns on iMessage, the device generates two pairs of keys for use with the service: an RSA 1280-bit key for encryption and an ECDSA 256-bit key for signing.

1. Is it best practice to use a different set of keys for signing than for encryption?
2. If so, what are the advantages to it? I had been looking at writing some software that used a single RSA key pair for both signing and encryption but this has made me question it.
3. Is there also a specific reason they've used RSA for encryption of the AES keys, and ECDSA for signing?

Answer 1

1. Yes.

2. Modern cryptosystems are designed and analysed under the assumption that the key is never used for anything else. If you use your encryption keys for digital signatures, you are violating that assumption, and it is very easy to construct schemes where this violation will compromise security.

   It is possible to construct schemes that can use the same key, but there is little reason to do so.

3. I have not looked at the specifics of iMessage, but I suspect that every time you send a message, you encrypt that message for many recipients (each device, possibly), but sign only once. Each device will have to decrypt only one ciphertext, and verify one signature.

   RSA is very fast for encryption, while ECDSA is faster at verification. EC-based encryption would be more expensive for encryption. Apple's choices seem reasonable.