ISO/IEC 9796-2:2010

Overview

ISO/IEC 9796-2:2010 - "Information technology - Security techniques - Digital signature schemes giving message recovery - Part 2: Integer factorization based mechanisms" specifies three digital-signature schemes that provide message recovery. Two schemes are deterministic (non‑randomized) and one is randomized. The security of all three is based on the computational difficulty of integer factorization (large-number factoring). The standard defines how to produce keys and how to form, sign and verify message-recoverable signatures; however, key management and random number generation (required for the randomized scheme) are explicitly outside its scope.

Key topics and requirements

• Signature schemes giving message recovery: support for total or partial recovery of the original message from the signature to reduce transmission/storage overhead.
• Three mechanisms:
  • Two deterministic (non-randomized) schemes.
  • One randomized scheme (requires external RNG guidance).
  • The first mechanism is retained only for backward compatibility with existing implementations.
• Security basis: all schemes rely on the hardness of integer factorization (factorizing large moduli).
• Key production: methods for generating the public/private keys for the three schemes are specified.
• Message representative production: procedures for hashing, formatting, and preparing message representatives for signing and recovery.
• Signature production and verification model: clear signing, opening and message-recovery processes and error checks.
• Parameters and options: modulus length, trailer field options, capacity, and salt length (for the randomized scheme) are covered to guide secure parameter choices.
• Supplementary material: includes normative ASN.1 module, mask generation function, key production annex, and informative examples for implementation guidance.

Applications

ISO/IEC 9796-2:2010 is intended for systems that require:

• Compact digital signatures where the message (or part of it) can be recovered from the signature to save bandwidth and storage.
• Services such as entity authentication, data origin authentication, non‑repudiation and data integrity where message recovery is advantageous.
• Constrained environments (embedded devices, smart cards, secure tokens) and legacy systems needing backward-compatible integer-factorization-based signatures.

Who should use this standard

• Cryptographic implementers and library authors building message-recoverable signature support.
• Security architects and protocol designers specifying signature options for constrained or bandwidth-sensitive systems.
• Compliance officers and evaluators assessing implementations based on integer-factorization security.
• Product teams maintaining backward compatibility with older ISO/IEC 9796 implementations.

Related standards

• ISO/IEC 9796 (other parts) - Part 3 covers discrete-logarithm-based mechanisms.
• ISO/IEC 14888-1 - general digital signature framework (deterministic vs randomized).
• ISO/IEC 10118 - hash-function specifications referenced for hashing requirements.
• ISO/IEC JTC 1/SC 27 - committee responsible for IT security techniques.

Keywords: ISO/IEC 9796-2, digital signature schemes, message recovery, integer factorization, message-recoverable signatures, deterministic signatures, randomized signature.