Re: [Cfrg] testability of signature input/output parameters

[Nico Williams <[e-mail]>]

On Thu, Jun 04, 2015 at 03:21:33PM -0400, Rene Struik wrote:
> I think one lesson one can draw from "piecemeal polls" is that it
> might make it harder to consider system-wide trade-offs.

This sub-poll became clearly necessary after the poll as to determinism
started, since that's when the online vs. CR matter came up.  Even if
the chairs had foreseen that outcome and produced a more complete single
poll, the overall outcome would probably still have been that we want a
deterministic signature scheme because the alternative hasn't worked out
well in practice and it's easy to see how it is very difficult to make
it work out well in practice.  And once all these polls are done I
suppose the chairs could well ask to confirm the overall outcome, but
there's nothing wrong with organic discovery of consensus.

Incidentally, Watson L. pointed out earlier in this poll that maybe we
can't get a deterministic, online, and CR (independent of the hash
function) signature scheme.  Nothing has changed since then on that
front.

The trade-offs come out the same for me: deterministic is the first
priority, so we're down to choosing between online and CR.

Since one can always make an online and not-CR scheme out of an offline
scheme, that's clearly what we should do, and everyone can be pleased.
(There's an extra hashing step in this case, but if bulk data is the
source of the online requirement, then the extra hash step is a
performance non-issue.)

For me the only question left is whether we should specify an online
scheme tightly integrated with the off-line scheme #3.  At first I was
in favor of this, now I'm in favor of #2 alone.  Online by generic
construction will do.  But I'm not opposed to #3 either.  I'm just
opposed to #1 on account of the past failures we have seen with online
signature schemes: the hash functions we've used have had a bad history
on the CR front, and we don't really have the confidence we need on the
current batch of hash functions.

Perhaps *after* a decade of SHA-3 cryptanalysis research we'll find that
SHA-3 is good enough for an online signature scheme and then we might be
sad about the choice to have an offline scheme back in 2015, but that
sadness will not be due to the scheme becoming insecure as a result, but
just that we could have been less paranoid.  I can live with that.

Nico
--