Risks of publishing multiple signatures Is there a risk when publishing multiple signatures for the same message? For instance, an ECDSA key (using an EC key) and a RSA-PSS signature (using a RSA key).

The context of my question is the use of Web Crypto Javascript library, where the only signature algo implemented by Edge is RSA-PKCS1 (which is not the latest recommended algo).

I was thinking of producing multiple signatures using different algo/keys and let the client check the one it wants.
Is there a risk when publishing multiple signature for the same message ?


As long as the keys are independently generated, there's no risk. This simply follows from the fact that every forgery on the composite scheme - the message signed with $n$ different keys / signature schemes - immediately implies a forgery against at least one of underlying signature schemes. But because we assume these underlying ones to all be secure, the composite scheme is secure as well. And yes, RSA-PKCSv1.5 is also secure.


  What risks are there if the signatures are made with the same key?


If you re-use keys with different signature schemes, e.g. use the same key for RSA-PKCS and RSA-PSS, all bets are off by default in standard cryptographic security models and careful analysis is required to regain security statements. Examples of this include the standalones-secure CBC-MAC (a PRF for inputs which are not prefixes of each other) and OCB2 which used two related primitives with the same key in an insecure way. Without naming concrete schemes to be paired, a general statement is impossible - if they can even reuse the keys which is e.g. impossible for ECDSA and RSA-PSS as one uses a point on a curve as the public key and the other a ring with an exponent.


  However, providing two signatures lets say PKCS1/[SHA]256 and another PKCS1/SHA512 using the same private key, that would not be advisable. Right ?


This would be fine if PKCS1v1.5 signatures were secure for plaintexts without hashing, so a plain signature of 0x05 instead of hashing first would be secure. But this is not the case for PKCS1v1.5. So by default it's indeed not advisable to do this. If you really have to do it though, it could be fine on the grounds that random functions (SHA256 / SHA512) are practically unrelated in their I/O behavior.