Re: [Cfrg] testability of signature input/output parameters

[Watson Ladd <[e-mail]>]

On Thu, Jun 4, 2015 at 12:21 PM, Rene Struik <[e-mail]> wrote:

> I think one lesson one can draw from "piecemeal polls" is that it might
> make it harder to consider system-wide trade-offs.
>
> Hence, the questions in my email of yesterday, June 3, 2015, 5.14pm EDT,
> see http://www.ietf.org/mail-archive/web/cfrg/current/msg06875.html. I
> think these still stand.


Note that verifiers will still accept signatures generated with random k,
permitting the avoidance of double hashing while preserving the more than
collision property in systems which actually require this.


>
>
> Rene
>
> On 6/4/2015 2:36 PM, Nico Williams wrote:
>
>> On Thu, Jun 04, 2015 at 10:09:29AM -0400, Rene Struik wrote:
>>
>>> [...]
>>>
>> It isn't possible to write test vectors for non-deterministic signature
>> schemes unless you expose PRNG state or nonce inputs as explicit
>> arguments to the API.  Regardless of whether one chooses to do that or
>> not, non-deterministic signature schemes whose security falls apart when
>> nonces are reused (or are predictable) is a really bad idea.
>>
>> Anyways, we've already determined that we have consensus in favor of
>> deterministic signature schemes.  You could ask that that matter be
>> re-opened, but first re-read the threads that led there.
>>
>> Nico
>>
>
>
> --
> email: [e-mail] | Skype: rstruik
> cell: [phone] | US: [phone]
>
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> http://www.irtf.org/mailman/listinfo/cfrg
>



-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.