# Why digital signatures needs different algorithm

Why digital signatures uses algorithms such as DSA, ECDSA or RSA-PSS, and not just the RSA algorithm to encrypt the message hash with the private key? Is the choice more security or performance related and how?

• I'm sure this has been asked before (but still searching). Anyways, one reason of many: In RSA it is methematically possible to use either key to encrypt. But that doesn't mean all asymmetric encryption algos are like that. ... Don't be confused by the similarity of encrypting and signing in RSA - in general they are completely different things. Oct 21, 2018 at 9:32

When you use a mathematical primitive directly, it's often vulnerable to mathematical relationships. The raise-to-the-power-of-$d$-or-$e$-modulo-$n$ operation (sometimes called “textbook RSA” or “plain RSA”) has a simple mathematical structure so it's easy to find some of the transformations it allows. For example, suppose that you know that the signature of message $M_1$ is $S_1$ and the signature of $M_2$ is $S_2$. Then the signature of $M_1 \cdot M_2$ is $S_1 \cdot S_2$, because $S_1 S_2 = M_1^d M_2^d = (M_1 M_2)^d$ (all equalities are $\mod n$). You can forge a signature without knowing the private key. That's bad. And this is just one example.
Constructions such as PSS, and PKCS#1 v1.5 padding before it, avoid this kind of mathematical relationships. They encoded each message in such a way that there is no simple arithmetic transformation between valid encoded messages. PKCS#1 v1.5 does it by padding the message. For example, it avoids the attack above because $\mathrm{pad}(M_1) \cdot \mathrm{pad}(M_2)$ is not a valid padded message, so $S_1 \cdot S_2$ is not the signature of anything. PSS does it in a more complex way by masking the message and then padding the result.