Re: [Cfrg] testability of signature input/output parameters

[Nico Williams <[e-mail]>]

On Thu, Jun 04, 2015 at 12:54:40PM -0700, Watson Ladd wrote:
> Note that verifiers will still accept signatures generated with random k,
> permitting the avoidance of double hashing while preserving the more than
> collision property in systems which actually require this.

Right, special-purpose implementations can resort to such optimizations
because special-purpose implementations are more likely to manage the
requisite state and/or TRNG.  But for general purpose implementations we
should have deterministic behavior.

Note also that verification for message-derived k schemes is still
online (though implementations should generall not permit access to the
message prior to signature verification).  It's only the signature
function that is made offline by the CR constructions we've discussed.

Nico
--