D. J. Bernstein
Authenticators and signatures

A state-of-the-art public-key signature system

Specification

Secret keys; public keys
The constant c
Signatures; verification
Hashing
Standard signatures; signing
Expanded signatures
Compressed signatures
Credits

Security

Cryptanalysis

Papers

[rwtight] 13pp, draft. (PDF) (PS) (DVI) D. J. Bernstein. Proving tight security for standard Rabin-Williams signatures. Document ID: c30057d690a8fb42af6a5172b5da9006. URL: http://cr.yp.to/papers.html#rwtight. Date: 2003.09.26. (This paper introduces standard signatures and presents a security proof.)

[sigs] 11pp. (PDF) (PS) (DVI) D. J. Bernstein. A secure public-key signature system with extremely fast verification. URL: http://cr.yp.to/papers.html#sigs. (This is mostly of historical interest now; it discusses an earlier design of the signature system.)

This signature system is discussed on the sigs mailing list.

An old version of the software, for an earlier design of the signature system, is sigs-0.50.tar.gz.

Relevant talks: 1997.03.07, ``The world's fastest digital signature system.'' 1997.03.17, ``The world's fastest digital signature system.'' 1997.10.25, ``A secure digital signature system with verification ten times faster than RSA.'' 2000.10.20 (slides and video available), ``Design and implementation of a public-key signature system.'' 2001.06.13, ``The state of the art in RSA-type signatures.'' 2003.04.24 (slides available), ``Compressing RSA keys and signatures.'' 2003.11.08 (slides available), ``News from the Rabin-Williams front.'' 2003.11.08 (slides available), ``More news from the Rabin-Williams front.'' 2004.08.17 (slides available), ``Stop overestimating RSA bandwidth!'' 2004.09.16 (slides available), ``A state-of-the-art public-key signature system.''