Re: [Cfrg] Elliptic Curves - signature scheme: randomised or not (ends on May 13th)

[Nico Williams <[e-mail]>]

On Mon, May 11, 2015 at 08:02:13PM -0000, D. J. Bernstein wrote:
> Nico Williams writes:
> > replacing M with H(M) in the second hash
> 
> This makes the signature scheme vulnerable to collisions in H. This
> _shouldn't_ be a problem, since the community puts a lot of effort into
> designing hash functions for which finding collisions seems to be
> extremely difficult; but it's safer to build collision-resilient
> signature systems, using collisions as an early-warning mechanism.

Right.  Fot the record, I'd prefer to not replace M with H(M) in the
derivation of k.  Instead I'd rather not have hardware like Andrey
posited.

It is clear that some users have a use for randomized k's, and that will
interop with a deterministic, stateless signature scheme that derives k
from the secret key and the message.  There's no way to prevent that,
so/and we shouldn't try, but the signature scheme that CFRG settles on
should be deterministic and stateless as specified.

Nico
--