On Jan 26, 2011, at 5:51 AM, Paul Crowley wrote:
> If you were choosing a signature scheme for a new application and you were
> not constrained by existing standards or code, what would you choose?
>
> Desirable properties might include:
>
> * small signatures
> * fast signature generation
> * fast signature verification
> * conservative choice of hard problem
> * a tight reduction to the hard problem (perhaps with random oracles)
> * free from patent claims
What, you don't want a pony, too? I mean, heck, you're asking for good, cheap,
*and* fast, so why not ask for a pony and a free trip to Disneyland while
you're at it?
>
> For concreteness, let's suppose the application is signing revisions in a
> distributed revision control system. I think the requirements for such a
> thing are typical of a great many settings where digital signatures are used:
> in these cases we largely assume that signing and revision are going to take
> place on PCs, so security and freedom from patent claims are most important,
> followed by size of signatures, and speed of signing and verification are
> secondary so long as they are within reasonable bounds.
>
> One choice might be Rabin-Williams signatures, which offer very fast
> verification and a tight reduction to integer factorization. However, the
> signatures are large compared to eg Schnorr, and as described above,
> signature size is often more important than speed. What would you recommend?
Given what you've said above, RSA.
Assuming you have the software engineering savvy to handle random numbers
properly, DSA is a good alternative because its signatures are proportional to
the size of the hash, rather than the key. But DSA is dodgy in the sense that
if you screw up your RNG, you leak the private key. There's a way to take care
of that that a number of people have done, including PGP by pseudo-encrypting
the random number to the private key, but that slows you down. But DSA is fast
to sign and slow to verify, and RSA proponents have always dinged it for that.
Why are you leaning to Rabin-Williams for all the features that are also
features of RSA? People don't break signatures because of hard problems, they
break them because the software has bugs in it. You're discussing the
resistance of the walls to a chainsaw, while leaving a bread tie on a hasp as
the lock.
Jon
_______________________________________________
cryptography mailing list
[email protected]
http://lists.randombit.net/mailman/listinfo/cryptography
