Which signature algorithms can also encrypt, which support blind signatures, and which have EC variants?

Question

Accepted Answer

Only RSA and ElGamal can both encrypt and sign. DSA, Schnorr, and Nyberg-Rueppel are signature-only algorithms. All except RSA have EC variants, and only RSA relies on factoring — the others use discrete logarithms.

* RSA is the lone factoring scheme (encrypt+sign, no EC); the discrete-log family adds EC variants, and only ElGamal among them also encrypts. *
Comparison of signature algorithms:

Algorithm
Encrypt?
Sign?
Blind Sig?
EC Variant?
Hard Problem

RSA
Yes
Yes
Yes
No
Factoring

ElGamal
Yes
Yes
Yes
Yes
Discrete Log

DSA
No
Yes
Yes
Yes (ECDSA)
Discrete Log

Schnorr
No
Yes
Yes
Yes
Discrete Log

Nyberg-Rueppel
No
Yes
Yes
Yes
Discrete Log

Key distinctions:

RSA is unique: the only algorithm based on factoring, and the only one without an EC variant
DSA was designed by NIST specifically to avoid RSA patents — signature-only by design
Schnorr is similar to DSA but with a different verification process
ElGamal is the most versatile of the discrete-log schemes (encrypt + sign + blind)

Important: Know which algorithms can encrypt vs. only sign — it's a common point of confusion.
Go deeper:

Digital signature — schemes overview — the broader map of signature algorithms and their security assumptions.
 ElGamal signature scheme — the versatile discrete-log scheme that, unlike DSA/Schnorr, also encrypts.

Algorithm	Encrypt?	Sign?	Blind Sig?	EC Variant?	Hard Problem
RSA	Yes	Yes	Yes	No	Factoring
ElGamal	Yes	Yes	Yes	Yes	Discrete Log
DSA	No	Yes	Yes	Yes (ECDSA)	Discrete Log
Schnorr	No	Yes	Yes	Yes	Discrete Log
Nyberg-Rueppel	No	Yes	Yes	Yes	Discrete Log