Re: [Cfrg] Elliptic Curves - signature scheme: randomised or not (ends on May 13th)

[Nico Williams <[e-mail]>]

On Mon, May 11, 2015 at 05:18:02PM -0700, Andrey Jivsov wrote:
> This is a somewhat separate question about the hashing twice
> (https://www.ietf.org/proceedings/92/minutes/minutes-92-cfrg search
> for "twice"), but I view that the related concerns supports the idea
> of a random k esp. with protocols that deal with messages of
> unlimited size.
> 
> Nico: you are against the interpretation of EdDSA as done in https://tools.ietf.org/html/draft-koch-eddsa-for-openpgp-00#section-5.
> If you are against, consider what the code like "cat InFile | gpg
> --clearsign" suppose to do then? (I assume that this piping is what
> influenced this particular interpretation of EdDSA.)

If we need online signing for some applications, then we can have it,
either because those applications hash the message first, then sign, or
because we have two signature functions, one online one not.

> >It is clear that some users have a use for randomized k's, and that will
> >interop with a deterministic, stateless signature scheme that derives k
> >from the secret key and the message.  There's no way to prevent that,
> >so/and we shouldn't try, but the signature scheme that CFRG settles on
> >should be deterministic and stateless as specified.
> 
> I generally agree with this. Just don't criminalize / recognize the
> benefit of random 'k' (with the security caveats).

There's no IETF police.

Nico
--