If we wished to, is there a comprehensive alternative to RSA?
I say comprehensive as I wonder if there is one which does both encryption and digital signature like RSA?
If not, simply what alternatives are there?
$\begingroup$
$\endgroup$
9
-
$\begingroup$ When you say "does both encryption and digital signature" what do you mean? You mean a single key can support both operations? $\endgroup$– mikeazoNov 30, 2015 at 14:14
-
3$\begingroup$ In practice, you do use a separate algorithm for signing vs encryption for RSA as we have some pre-processing we must do for security and practicality reasons. For example, we typically hash the message first and add some padding. $\endgroup$– mikeazoNov 30, 2015 at 14:57
-
2$\begingroup$ RSA is the only known trapdoor permutation, so in that sense there isn't a comprehensive alternative. $\endgroup$– pg1989Nov 30, 2015 at 17:40
-
1$\begingroup$ raw Rabin isn't, since the squaring map in Z/NZ is four-to-one. $\endgroup$– pg1989Nov 30, 2015 at 17:58
-
1$\begingroup$ I got curious too - check section 2.3.5: cseweb.ucsd.edu/~mihir/papers/gb.pdf $\endgroup$– pg1989Nov 30, 2015 at 18:03
|
Show 4 more comments
1 Answer
$\begingroup$
$\endgroup$
Yes.
You can use RSA for both signatures and encryption, but you need different algorithms for that. E.g. RSAES-OAEP is an encryption algorithm, while RSASS-PSS is a signature algorithm. Both use the RSA cryptosystem and have similar keys, but otherwise the algorithms differ. Textbook RSA has the "same" algorithm for both but is not secure.
There are alternatives where something similar is possible. Elliptic curves are the most practical and widely used option. The same curve can be used for encryption (e.g. ECIES) and signatures (e.g. ECDSA).
Note that using the same key-pair for both encryption and signatures is not necessarily secure, even if the algorithms allow it. So in practice you could use completely different algorithms for signatures and encryption without too much overhead, but you may save e.g. code size by using related algorithms for both. And you may rely on fewer hardness assumptions that way.
