# Digital signature algorithms within the European Union

I've just noticed that US NIST has accepted DSA as a digital signature standard. Does the European Union have a similar standard, specifying an algorithm to use when digitally signing messages?

I have been looking this up for some time now, but I fail to find a reasonable answer.

• I don't know for sure if there's anything else, but europe actually accepted DSA as signature algorithm - no need to invent their own. The only exception may be (EC)GDSA which is just a minor modification. For ECGDSA refer to TR-03111 – SEJPM Aug 23 '15 at 15:35
• @SEJPM - thanks for your comment, it has helped in searching by using alternative wording. I found that enisa.europa.eu has a wealth of information on the subject. In short: there are a lot of recommendations, but each member state applies its own algorithms for the moment. The PDF on this page is from 2011, but sums it up enough, for me enisa.europa.eu/activities/identity-and-trust/library/… – twan163 Aug 23 '15 at 16:59

## 3 Answers

Except if you are picky with updates of references, there is such standard. DSA, RSA, ECDSA-$F_p$, ECDSA-$F_{2^n}$, are approved by ETSI TS 102 176-1 V2.1.1 (2011-07) (Electronic Signatures and Infrastructures (ESI); Algorithms and Parameters for Secure Electronic Signatures; Part 1: Hash functions and asymmetric algorithms), which essentially is an update of ETSI SR 002 176 V1.1.1 (2003-03) (Algorithms and Parameters for Secure Electronic Signatures), which is referenced by CWA 14169:2004 (Secure signature-creation devices “EAL 4+”), which (in an earlier edition that it supersedes) is referenced by Commission decision 2003/511/EC (on the publication of reference numbers of generally recognised standards for electronic signature products in accordance with Directive 1999/93/EC of the European Parliament and of the Council).

However, updates of both CWA 14169 and ETSI SR 002 176 have broken the formal chain of approval, with no official repairs that I am aware of. The state of things is that Member States have their own rules, AFAIK. For France, that is currently RGS 2.0 and its annex B.1 (both in french).

The European Union did not specify an own digital signature standard. More generally, there are several recommendations which algorithms to use for which setting (as already described in other answers and comments). However, so far the EU left it to the US and especially to NIST to run competitions for new algorithm designs and to standardize them (see the SHA-3 or the AES competition). This might change given the recent revelations.

Although the documents referenced so far are interesting in their own right, the actual relevant (as in "giving a legal value to the signatures") ETSI standard here is ETSI TS 119 312.

Note also that the venerable 1999/93/EC Directive on electronic signatures is being replaced by the much more ambitious eIDAS regulation. As a regulation, it applies directly in all Member States and supersedes any national conflicting arrangement, which should greatly improve interoperability.