Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've been looking at the EMV draft specification (pdf) for using Eliptic Curve Cryptography in payment cards instead of the currently used RSA. One thing I've noticed is that they've moved from using the RSA Digital Signature Scheme (DSS) giving Message Recovery to ECC DSS with Appendix. My question is why would this change, from Message Recovery to Appendix, have been made? What advantages does Appendix offer over Message Recovery?

I know how both DSS schemes work but all I can see so far is that messages with Appendix are longer than their Message Recovery counterparts.

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Ok, let's avoid confusing terminology, because "DSS" also means "digital signature standard" as in FIPS 186-3, which is not at all RSA.

RSA is a signature scheme "with recovery", meaning that there is a bit of room to embed some arbitrary data within the signature itself. The document you quote uses ISO 9796-2, which implements this kind of embedding. For instance, if you have a 2048-bit RSA key and used it with SHA-256 as hash function, then the signature has length 256 bytes, but you can reuse 222 bytes for your message, so the actual size overhead for the signature will be only 34 bytes. On the other hand, ECDSA (the elliptic curve signature scheme which your document alludes to) does not have the "recovery" feature, so while a robust ECDSA signature is shorter than a RSA signature of similar strength (e.g. about 64 bytes for something as good as RSA-2048), the actual size overhead is higher (i.e. 64 bytes). All of this depends on the key sizes and used hash functions; your mileage may vary.

Security of ISO 9796-2 is questionable (basically, you don't get your money worth from your hash function output size; you must use a hash function with a larger output to regain your security, increasing the size overhead). Also, ECDSA is computationally less expensive for signature generation, and that can be important for some low-power embedded devices. On the other hand, RSA is mathematically simpler, more widely used and supported (because it is quite older), and, depending on the parameters, may offer a slight size advantage.

Anything with elliptic curves is, of course, highly fashionable.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.