Q:

Where is RSA Digital signature used in the online banking world?

When i do online banking, i sign my digital transaction with a digipass. Ive been told that it uses a RSA-based digital signature scheme. But an rsa digital signature (1024 bit for the modulus) is a much greater then length of the code that my digipass generates. How does this work? Is it the PKCS#11 specification at work? Or?
Thanks for the explanation!

A:

There are several Digipass products; not all of them compute digital signatures with the meaning that cryptographers attach to this expression (i.e. RSA and its ilk). If your token is not plugged into the machine, but just generates a numeric code which you type in, then there is no RSA involved. This does not prevent some documentations from (ab)using the term "signature" in that case too (I blame Microsoft for that confusion).
PKCS#11 is an API which applications use to talk to cryptographic hardware: this API is implemented by the driver for the specific hardware you use. For a token which is not plugged in at all, then there is no hardware (from the point of view of the computer), hence no driver, hence no PKCS#11.

