2
$\begingroup$

When comparing the RSA-PSS signature algorithm with an elliptic curve based algorithm such as EdDSA, it is clear that signature verification takes less time for RSA than for EdDSA. For signature generation the situation is vice versa. I am asking myself whether there are use cases were a fast signature verification is an important requirement and were RSA would be actually the preferred choice?

Remark: I know that these elliptic curve based algorithms are generally more secure and have shorter keys then EC based algorithms. Thus, from these perspectives, EdDSA would be more appealing.

Improve this question
$\endgroup$
1
  • 2
    $\begingroup$ Like all algorithms, it depends on the application. There are many cases where the efficiency of an operation is absolutely not important, others where an order of magnitude slower is not a big deal, and yet others where fractions of a millisecond are critical. List your requirements (signatures per second, verifications per second, key sizes, library support, who performs which operations, etc...) and choose an appropriate algorithm that matches the requirements. $\endgroup$ – Marc Aug 27 '20 at 13:07
3
$\begingroup$

I am asking myself whether there are use cases were a fast signature verification is an important requirement and were RSA would be actually the preferred choice?

Well, as you already mentioned the comparison is a bit tricky. For 128 bit security you'd use ECC-256 and RSA-3072 (and using 3072 is on the low end). For most RSA implementations 3072 seems at the high end.

However, the main place where quick verification is important in PKI. Generation of signatures below certificates is generally only performed once, while verification of certificate chains happens all the time. Generally you'd try and cache verified / trusted certificates, but remember that all receivers (such as browsers) must initially verify the certificates none-the-less.

Note that smart cards also may use a PKI using more simplistic Card Verifiable certificates. For smart cards the smaller ECC keys and signatures are an important factor: both IO and RAM is usually limited. So in that case ECC may be more efficient than RSA. There are often other properties than raw CPU time to consider.

Improve this answer
$\endgroup$
4
  • 2
    $\begingroup$ "although you could in principle cache signature verification results, I suppose"; actually, caching intermediate certificates once you have verified them is standard practice... $\endgroup$ – poncho Aug 27 '20 at 15:04
  • 1
    $\begingroup$ Alright. You'd still have two signatures to verify in that case of course: the one under the leaf cert and the one to perform the actual authentication (although the latter requires signature generation as well, so it won't imbalance the signature generation & verification). $\endgroup$ – Maarten Bodewes♦ Aug 27 '20 at 15:56
  • 1
    $\begingroup$ Another common use case where we verify a signature many times, making RSA preferable, is signature of executable code. $\endgroup$ – fgrieu♦ Aug 27 '20 at 21:11
  • $\begingroup$ Yeah, I guess when you start looking at one producer many consumers then you'll quickly find more. Signed configuration files is a similar one (although often the same cert is used for that). I also thought up one where multiple signatures may be generated but almost never consumed: audit logging. $\endgroup$ – Maarten Bodewes♦ Aug 27 '20 at 22:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.