If you were choosing a signature scheme for a new application and you
were not constrained by existing standards or code, what would you choose?
Desirable properties might include:
* small signatures
* fast signature generation
* fast signature verification
* conservative choice of hard problem
* a tight reduction to the hard problem (perhaps with random oracles)
* free from patent claims
For concreteness, let's suppose the application is signing revisions in
a distributed revision control system. I think the requirements for
such a thing are typical of a great many settings where digital
signatures are used: in these cases we largely assume that signing and
revision are going to take place on PCs, so security and freedom from
patent claims are most important, followed by size of signatures, and
speed of signing and verification are secondary so long as they are
within reasonable bounds.
One choice might be Rabin-Williams signatures, which offer very fast
verification and a tight reduction to integer factorization. However,
the signatures are large compared to eg Schnorr, and as described above,
signature size is often more important than speed. What would you
recommend?
Thanks!
--
__
\/ o\ Paul Crowley, [email protected]
/\__/ http://www.ciphergoth.org/
_______________________________________________
cryptography mailing list
[email protected]
http://lists.randombit.net/mailman/listinfo/cryptography
