Overview
ISO/IEC 9796-2:2010 - "Information technology - Security techniques - Digital signature schemes giving message recovery - Part 2: Integer factorization based mechanisms" specifies three digital-signature schemes that provide message recovery. Two schemes are deterministic (non‑randomized) and one is randomized. The security of all three is based on the computational difficulty of integer factorization (large-number factoring). The standard defines how to produce keys and how to form, sign and verify message-recoverable signatures; however, key management and random number generation (required for the randomized scheme) are explicitly outside its scope.
Key topics and requirements
- Signature schemes giving message recovery: support for total or partial recovery of the original message from the signature to reduce transmission/storage overhead.
- Three mechanisms:
- Two deterministic (non-randomized) schemes.
- One randomized scheme (requires external RNG guidance).
- The first mechanism is retained only for backward compatibility with existing implementations.
- Security basis: all schemes rely on the hardness of integer factorization (factorizing large moduli).
- Key production: methods for generating the public/private keys for the three schemes are specified.
- Message representative production: procedures for hashing, formatting, and preparing message representatives for signing and recovery.
- Signature production and verification model: clear signing, opening and message-recovery processes and error checks.
- Parameters and options: modulus length, trailer field options, capacity, and salt length (for the randomized scheme) are covered to guide secure parameter choices.
- Supplementary material: includes normative ASN.1 module, mask generation function, key production annex, and informative examples for implementation guidance.
Applications
ISO/IEC 9796-2:2010 is intended for systems that require:
- Compact digital signatures where the message (or part of it) can be recovered from the signature to save bandwidth and storage.
- Services such as entity authentication, data origin authentication, non‑repudiation and data integrity where message recovery is advantageous.
- Constrained environments (embedded devices, smart cards, secure tokens) and legacy systems needing backward-compatible integer-factorization-based signatures.
Who should use this standard
- Cryptographic implementers and library authors building message-recoverable signature support.
- Security architects and protocol designers specifying signature options for constrained or bandwidth-sensitive systems.
- Compliance officers and evaluators assessing implementations based on integer-factorization security.
- Product teams maintaining backward compatibility with older ISO/IEC 9796 implementations.
Related standards
- ISO/IEC 9796 (other parts) - Part 3 covers discrete-logarithm-based mechanisms.
- ISO/IEC 14888-1 - general digital signature framework (deterministic vs randomized).
- ISO/IEC 10118 - hash-function specifications referenced for hashing requirements.
- ISO/IEC JTC 1/SC 27 - committee responsible for IT security techniques.
Keywords: ISO/IEC 9796-2, digital signature schemes, message recovery, integer factorization, message-recoverable signatures, deterministic signatures, randomized signature.
Open preview (PDF)Information technology — Security techniques — Digital signature schemes giving message recovery — Part 2: Integer factorization based mechanisms