ISO/IEC 14888-1:2008

Overview

ISO/IEC 14888-1:2008 specifies general principles and requirements for digital signatures with appendix - a class of asymmetric cryptographic mechanisms where the verifier requires the message as part of the verification input. The standard defines the model, terminology, and mandatory processes (key generation, signature process, verification process) and sets security objectives for signature mechanisms that use a collision-resistant hash-function to compute the appendix appended to a message.

Key topics and technical requirements

• Signature mechanism with appendix: Defines how a signature (the appendix) and optional text field are formed and attached to a message so verifiers can relate the signature to the message.
• Core processes: Requirements for key generation, the signature process (probabilistic or deterministic) and the verification process.
• Security properties: The standard requires that given only the verification key it is computationally infeasible to forge valid message/signature pairs, recover the private signature key, or find two different messages that share the same signature.
• Hash-function binding: Strong emphasis on binding the chosen hash-function to the signature mechanism to prevent forgery. The document describes options for binding (restricting to a single hash-function, indicating the hash in certificate domain parameters, or specifying the hash in the message) and warns of associated risks.
• Notation and conventions: Defines symbols (H, M, X, Y, Σ, etc.), coding conventions and formats for constructing the appendix and signed message.
• Implementation choices and options: Specifies options for how identification data and optional text fields can be used to convey signer identity or verification key information.

Applications and who uses it

ISO/IEC 14888-1 is aimed at organizations and professionals implementing or evaluating digital signature systems that require the full message for verification:

• Security architects and cryptographic engineers designing PKI-aware applications
• Software developers building signing/verification libraries or secure messaging systems
• PKI operators, certificate authorities and system integrators specifying certificate parameters and hash-policy bindings
• Auditors, compliance officers and security assessors validating that signature mechanisms meet recognized security properties

Practical uses include document signing, code signing, secure email, authentication of transactions, and any application requiring data origin authentication, integrity and non-repudiation using an appendix-style digital signature.

Related standards

• ISO/IEC 14888-2: integer factorization–based mechanisms
• ISO/IEC 14888-3: discrete logarithm–based mechanisms
• ISO/IEC 9796: signature mechanisms giving message recovery
• ISO/IEC 10118: hash-function specifications

Keywords: ISO/IEC 14888-1:2008, digital signatures with appendix, signature mechanism with appendix, hash-function, collision-resistant hash, verification key, signature key, key generation, signature process, verification process, PKI.