← Back to Blog Research

ISO/IEC 14888 Digital Signature Standards

12 min read

A digital signature does two jobs: it proves who created a piece of data (authenticity) and it proves the data has not been changed (integrity). Without trustworthy signatures, a software update could be malware, a financial transfer could be a forgery, and a medical record could be silently altered. International commerce relies on signatures working correctly across borders, vendors, and decades.

The international standard for digital signatures is ISO/IEC 14888. It is a multi-part document maintained by ISO/IEC JTC 1 / SC 27. Part 1 defines the framework. Part 2 covers signatures with message recovery. Part 3 covers signatures with appendix (the most common type). Part 4 covers stateful hash-based schemes.

This post walks through each part, explains how they relate to NIST FIPS standards, and previews the post-quantum amendments that will add ML-DSA, SLH-DSA, and FN-DSA. For software making compliance claims internationally, ISO/IEC 14888 is the reference.

What ISO/IEC 14888 Covers

ISO/IEC 14888 is the international counterpart to NIST FIPS 186 (Digital Signature Standard). FIPS 186 is the US baseline; ISO/IEC 14888 is the international baseline. The technical algorithms overlap heavily because both standards bodies converge on the same primitives.

The four current parts:

Part 1: General. Framework, terminology, conformance.
Part 2: Mechanisms using a hash-function and message recovery. Schemes where the message is reconstructed from the signature.
Part 3: Discrete logarithm based mechanisms. ECDSA, EdDSA, Schnorr, etc.
Part 4: Stateful hash-based mechanisms. LMS and XMSS.

A planned amendment will add Part 5 or extend Part 3 with PQC signatures: ML-DSA, SLH-DSA, FN-DSA.

Part 1: General Framework

ISO/IEC 14888-1:2008 (with revision in progress) defines the model for digital signature mechanisms. Key concepts:

Key generation: how a signer produces a key pair
Signature generation: how a signer creates a signature on a message
Signature verification: how anyone can verify a signature using the public key
Message recovery vs appendix: whether the original message can be reconstructed from the signature alone (recovery) or must be supplied separately (appendix)
Determinism vs randomization: some schemes use random values during signing; others derive everything from the message and key

The 2008 version is being revised to align with current cryptographic practice and prepare for PQC. The revision is expected to publish in 2026.

Part 2: Signatures with Message Recovery

ISO/IEC 14888-2:2008 covers signature schemes with message recovery. The message is encoded into the signature; verification recovers it. RSA-PSS is the dominant algorithm here.

RSA-PSS (Probabilistic Signature Scheme) was designed to fix structural weaknesses in older RSA signature schemes. It uses a salt and a mask generation function to randomize the signature, defeating chosen-message attacks that worked against the simpler PKCS#1 v1.5 scheme.

Other schemes in Part 2:

ISO/IEC 9796-2 mechanisms (older, less common)
Some elliptic curve schemes with message recovery

PKCS#1 v1.5 (the older RSA scheme) is in Part 2 for legacy compatibility. It is no longer recommended for new use. RSA-PSS is the modern replacement.

For PQC, message recovery is harder to implement efficiently. ML-DSA, SLH-DSA, and FN-DSA are all signatures with appendix (no message recovery). So Part 2 will likely remain RSA-only as the technology matures.

Part 3: Signatures with Appendix

ISO/IEC 14888-3:2018 (with amendments) is the main document for digital signatures. Schemes here include the message and signature separately; the verifier needs both.

Algorithms in current Part 3:

ECDSA: Elliptic Curve Digital Signature Algorithm. Widely deployed in TLS, code signing, blockchain.
Schnorr signatures: Used in EdDSA (Ed25519, Ed448) and various blockchain protocols (Bitcoin Taproot).
EdDSA: Edwards-curve DSA. Ed25519 is the most common variant.
EC-KCDSA: Korean variant.
EC-GDSA: German variant.
EC-RDSA: Russian variant.
DSA: Original NIST DSA over finite field, deprecated.

ECDSA is the most deployed signature scheme globally. It is in TLS certificates, SSH keys, EMV payment cards, and most modern protocols.

EdDSA / Ed25519 has gained ground because of its simpler implementation, deterministic signatures (no random number generator failure mode), and faster performance. QNSQY uses Ed25519 in hybrid mode with ML-DSA. See hybrid encryption.

Part 4: Stateful Hash-Based Signatures

ISO/IEC 14888-4 is in development. It will cover stateful hash-based signature schemes:

LMS (Leighton-Micali Signatures), specified in IETF RFC 8554
XMSS (eXtended Merkle Signature Scheme), specified in IETF RFC 8391
HSS (Hierarchical Signature System), the multi-tree variant of LMS

These schemes are quantum-resistant because they rely only on cryptographic hash function security (SHA-256 or similar). Hash functions are quantum-resistant if you double the output size (Grover's algorithm only gives a square-root speedup).

The catch is the word "stateful." LMS and XMSS keys can sign only a fixed number of messages. After that limit, the key is exhausted. Worse, the signer must track which one-time keys have been used. Reusing a one-time key destroys security entirely. This makes LMS and XMSS dangerous for general use but excellent for narrow applications: firmware signing, infrequent code releases, long-lived signing operations where state can be carefully managed.

NIST published SP 800-208 in 2020 covering stateful hash-based signatures. ISO/IEC 14888-4 will mirror this guidance for international use. See LMS stateful signatures.

QNSQY supports LMS in the Business tier for users who need quantum-resistant signatures with the smallest assumption set (only hash function security). It is not enabled by default because the state management requirements are tricky.

RSA-PSS Deep Dive

Since RSA-PSS dominates Part 2, a closer look is warranted.

The basic idea: pad the message with random salt and structured padding before applying RSA. The padding is designed so:

Different signings of the same message produce different signatures (probabilistic)
Forgery requires breaking RSA itself, not just guessing structure
The signature is verifiable using only the public key, message, and signature

RSA-PSS is in widespread use, but its quantum vulnerability is the same as plain RSA: Shor's algorithm breaks the underlying RSA problem in polynomial time on a sufficient quantum computer. So RSA-PSS will be deprecated alongside other RSA uses in NIST and CNSA 2.0 timelines (2030 to 2035 for general use).

For now, RSA-PSS remains the most interoperable signature for systems that have not migrated to ML-DSA or hybrid signatures. ISO/IEC 14888-2 codifies its use.

ECDSA and EdDSA Comparison

Both are in Part 3. Both are deployed widely. But they have important differences:

ECDSA uses random k values during signing. If k repeats or leaks, the private key can be derived (the famous PlayStation 3 hack). Implementations must use a secure random source.
EdDSA is deterministic. The randomness for each signature is derived from the message and a hash of the key. No external RNG dependency, no failure mode if the RNG is bad.

For new deployments, EdDSA / Ed25519 is preferred. For interoperability with legacy systems, ECDSA is unavoidable.

QNSQY uses Ed25519 in hybrid signatures. The classical signature is Ed25519, the post-quantum signature is ML-DSA. Both are produced over the same data. A verifier checking either signature gets confidence in authenticity; checking both gets confidence even if one algorithm is later broken.

PQC Amendments to ISO/IEC 14888

As of 2025, ISO/IEC 14888 is being amended to include post-quantum signatures. The expected additions:

ML-DSA (Module-Lattice Digital Signature Algorithm), based on CRYSTALS-Dilithium, NIST FIPS 204. Three parameter sets (44, 65, 87) for security levels 2, 3, 5.
SLH-DSA (Stateless Hash-Based Digital Signature Algorithm), based on SPHINCS+, NIST FIPS 205. Stateless hash-based signatures, larger but simpler than LMS.
FN-DSA (Fast Fourier Lattice Signatures), based on Falcon, NIST FIPS 206. Lattice-based with smaller signatures than ML-DSA but more complex implementation.

The amendment is expected in 2026. Once published, ML-DSA, SLH-DSA, and FN-DSA become part of the international signature baseline. Procurement language in EU government contracts and Asian regulatory frameworks will start referencing them.

For QNSQY, the practical effect is that ML-DSA used today already aligns with what ISO/IEC will codify. The hybrid mode (Ed25519 + ML-DSA) gives transition coverage. See NIST FIPS guide for FIPS 204 details.

Choosing Between Signature Algorithms

A practical guide for picking a signature algorithm in 2026:

General use, modern deployment: Ed25519 (interoperable, fast, secure)
Legacy compatibility: ECDSA P-256 (still everywhere)
PQC in addition to classical: ML-DSA-44 (security level 2) or ML-DSA-65 (security level 3)
Stateful PQC for firmware: LMS or XMSS with careful state management
Stateless PQC, hash only: SLH-DSA (large signatures but simplest assumption)
Smallest PQC signature: FN-DSA (Falcon, complex implementation, side-channel risk)

Hybrid mode is recommended during the PQC transition. NIST, NSA, ENISA, and BSI all suggest combining classical and PQC signatures so security holds if either algorithm fails. QNSQY implements this by default with Ed25519 + ML-DSA.

Implementation Considerations

For each signature scheme, ISO/IEC 14888 specifies test vectors and conformance criteria. Implementations must:

Pass official test vectors (KAT)
Use approved hash functions (SHA-256, SHA-3, SHAKE)
Handle edge cases (zero messages, identity points, etc.)
Resist side-channel attacks for the deployment environment

Validation under ISO/IEC 19790 (the module standard) requires test vector compliance. NIST CAVP testing is largely equivalent and accepted in many ISO contexts.

Conformance, OIDs, and Encoded Identifiers

International signature interoperability rests on agreement about Object Identifiers (OIDs) for each algorithm. ISO/IEC 14888 references the OID assignments held by various registration authorities, including the NIST CSOR (Computer Security Objects Register), the IETF assignments under iso.org.dod.internet.security, and national OIDs assigned by local standards bodies.

For ML-DSA, NIST CSOR allocated OIDs in late 2024 under the NIST PQC arc. ML-DSA-44 is 2.16.840.1.101.3.4.3.17, ML-DSA-65 is 2.16.840.1.101.3.4.3.18, and ML-DSA-87 is 2.16.840.1.101.3.4.3.19. These OIDs appear in X.509 certificate signatures, in CMS message structures, in PKCS#11 mechanism encoding, and in any other place where an algorithm identifier needs to be encoded as a binary OID.

ISO/IEC 14888 references these OIDs rather than redefining them. The encoding is consistent across NIST FIPS, IETF RFCs, and ISO documents because all three reference the same registry. Implementations that pass NIST CAVP test vectors with the NIST OIDs are conformant with ISO/IEC 14888 references to the same algorithms. Vendors writing certificate management code or cryptographic libraries should embed the NIST CSOR OID values directly rather than rolling their own assignments. The same applies to SLH-DSA OIDs (2.16.840.1.101.3.4.3.20 through 2.16.840.1.101.3.4.3.31 for the various parameter sets) and the upcoming FN-DSA OIDs that NIST plans to publish alongside FIPS 206 finalization.

FAQ

Are ECDSA signatures still safe?

For now, yes. ECDSA over P-256 or P-384 with SHA-256 is widely deployed and not yet broken by classical computers. But Shor's algorithm on a sufficient quantum computer breaks ECDSA quickly. CNSA 2.0 and NIST guidance both deprecate ECDSA after 2030 for new systems and disallow it after 2035 for high-security use.

What is the difference between ISO/IEC 14888-3 and NIST FIPS 186?

They are largely parallel. NIST FIPS 186-5 (2023) covers ECDSA, EdDSA, RSA, and DSA. ISO/IEC 14888-3 covers the same algorithms plus regional variants (Korean, Russian, German). For most products, complying with FIPS 186 also satisfies ISO/IEC 14888-3.

When will ML-DSA be in ISO/IEC 14888?

The amendment is in committee review. Expected publication is 2026. The technical content matches NIST FIPS 204, so implementations of ML-DSA today will be ISO compliant once the amendment publishes.

Does QNSQY support all the signature schemes in ISO/IEC 14888?

QNSQY supports the most relevant subset for file encryption and signing: Ed25519 (Part 3), ML-DSA (upcoming Part 3 amendment), and LMS (Part 4) for Business tier users. RSA-PSS is not implemented because new deployments should use Ed25519 or ML-DSA. See pricing.

What is FN-DSA?

FN-DSA is the NIST FIPS 206 name for the Falcon signature scheme. Falcon produces smaller signatures than ML-DSA but is harder to implement correctly because it uses floating-point arithmetic that requires care for constant-time, side-channel-resistant code. Most implementations stick with ML-DSA unless signature size is critical.

Does ISO/IEC 14888 cover threshold signatures?

Not yet in the published parts. Threshold signature schemes split a private key among multiple parties such that no single party can sign alone. Threshold variants of ECDSA, Schnorr, and BLS exist in the academic literature. NIST has a separate threshold cryptography project that is publishing guidance gradually. ISO/IEC SC 27 working groups are tracking the NIST work and may extend ISO/IEC 14888 with threshold schemes once the underlying primitives are NIST-standardized. For now, threshold signatures live outside the formal international signature standards baseline.

How do regional signature variants relate to the international baseline?

Part 3 includes EC-KCDSA (Korea), EC-GDSA (Germany), and EC-RDSA (Russia) as regional variants of ECDSA. These schemes exist because each country wanted a domestically governed signature primitive distinct from the US NIST track. Cryptographically they are similar to ECDSA with minor parameter differences. Procurement specifications from Korean, German, or Russian government buyers may require the regional variant. International products typically support ECDSA as the primary scheme and add the regional variants for specific compliance regimes.

Sources

ISO/IEC 14888-1:2008, "IT Security techniques, Digital signatures with appendix, Part 1: General." https://www.iso.org/standard/44226.html
ISO/IEC 14888-2:2008, "IT Security techniques, Digital signatures with appendix, Part 2: Integer factorization based mechanisms." https://www.iso.org/standard/44227.html
ISO/IEC 14888-3:2018, "IT Security techniques, Digital signatures with appendix, Part 3: Discrete logarithm based mechanisms." https://www.iso.org/standard/76382.html
NIST FIPS 186-5, "Digital Signature Standard," February 2023. https://csrc.nist.gov/pubs/fips/186-5/final
NIST SP 800-208, "Recommendation for Stateful Hash-Based Signature Schemes," October 2020. https://csrc.nist.gov/pubs/sp/800/208/final
NIST CSOR, "Computer Security Objects Register, PQC OID assignments." https://csrc.nist.gov/projects/computer-security-objects-register

Protect Your Data Before Q-Day Arrives

QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.

Try QNSQY