Re: [Cfrg] Elliptic Curves - signature scheme: randomised or not (ends on May 13th)

+1  I could not have put my arguments any better than Simon did. 
#2 is the only reasonable choice at this point. 

Olafur

> On May 5, 2015, at 10:22 AM, Simon Josefsson <simon@josefsson.org> wrote:
> 
> Alexey Melnikov <alexey.melnikov@isode.com> writes:
> 
>> 1. CFRG should stick to randomised signature schemes only.
> 
> No.
> 
>> 2. CFRG should adopt deterministic signature scheme only.
> 
> At this time, yes.
> 
> There are situations where you need non-determinism in a public-key
> signature scheme to achieve certain properties.
> 
> I believe it will eventually be useful for the CFRG to recommend a
> non-deterministic signature scheme that is better than RSA/DSA/ECDSA.
> 
> As Andy said, you can have a scheme that is secure in a deterministic
> setting but still accept ranndomness to achieve a non-deterministic
> signature, for wider applicability.
> 
> However the majority of applications under consideration today (e.g.,
> PKIX, TLS, S/MIME, OpenPGP) would directly benefit from having a good
> and easy to implement deterministic signature scheme, like EdDSA.
> 
> So I believe this should be the focus for the current agenda.
> 
>> 3. De-randomisation should be an optional feature for implementers to
>> decide upon (i.e. both choices 1 and 2 allowed).
> 
> No.
> 
> /Simon
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg