5
$\begingroup$

If we wished to, is there a comprehensive alternative to RSA?

I say comprehensive as I wonder if there is one which does both encryption and digital signature like RSA?

If not, simply what alternatives are there?

$\endgroup$
  • $\begingroup$ When you say "does both encryption and digital signature" what do you mean? You mean a single key can support both operations? $\endgroup$ – mikeazo Nov 30 '15 at 14:14
  • 3
    $\begingroup$ In practice, you do use a separate algorithm for signing vs encryption for RSA as we have some pre-processing we must do for security and practicality reasons. For example, we typically hash the message first and add some padding. $\endgroup$ – mikeazo Nov 30 '15 at 14:57
  • 2
    $\begingroup$ RSA is the only known trapdoor permutation, so in that sense there isn't a comprehensive alternative. $\endgroup$ – pg1989 Nov 30 '15 at 17:40
  • 1
    $\begingroup$ raw Rabin isn't, since the squaring map in Z/NZ is four-to-one. $\endgroup$ – pg1989 Nov 30 '15 at 17:58
  • 1
    $\begingroup$ I got curious too - check section 2.3.5: cseweb.ucsd.edu/~mihir/papers/gb.pdf $\endgroup$ – pg1989 Nov 30 '15 at 18:03
2
$\begingroup$

Yes.

You can use RSA for both signatures and encryption, but you need different algorithms for that. E.g. RSAES-OAEP is an encryption algorithm, while RSASS-PSS is a signature algorithm. Both use the RSA cryptosystem and have similar keys, but otherwise the algorithms differ. Textbook RSA has the "same" algorithm for both but is not secure.

There are alternatives where something similar is possible. Elliptic curves are the most practical and widely used option. The same curve can be used for encryption (e.g. ECIES) and signatures (e.g. ECDSA).

Note that using the same key-pair for both encryption and signatures is not necessarily secure, even if the algorithms allow it. So in practice you could use completely different algorithms for signatures and encryption without too much overhead, but you may save e.g. code size by using related algorithms for both. And you may rely on fewer hardness assumptions that way.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.