Re: [Cfrg] Elliptic Curves - signature scheme: friendliness to low memory implementations (ends on June 3rd)

[Adam Langley <[e-mail]>]

On Wed, May 20, 2015 at 5:00 PM, Nico Williams <[e-mail]> wrote:
> I'd rather this be cast in terms of online/offline.  The question isn't
> how much memory is needed, but whether the amount needed is fixed or
> unbounded (e.g., proportional to message length).

I think "online" is what's described in the question as the
"traditional" construction, i.e. operates in constant space. But could
you confirm so that I'm clear?

> Anyways, I think we should do #4, a rephrasing of #3, though I'm open to
> all options listed thus far:
>
> #4: provide both online and not-online signature schemes
>
> Users could use an offline scheme in an online way and hash the message
> themselves, but it seems best to do it in the scheme itself.

How would your #4 differ from #3? Would the signature scheme itself be
different? (As opposed to #3 which imagines a "wrapper" around a
signature scheme.) If so, wouldn't that be a bunch more complexity for
the specification and implementation?


Cheers

AGL