Re: [Cfrg] testability of signature input/output parameters

[Rene Struik <[e-mail]>]

Hi Ilari:

Well, neither do deterministic signatures seem to help here: if one 
presumes k=f(m,d) and indeed finds that, for fixed public signature key, 
repeats of message m produce the same signature, this does not 
necessarily imply that f depends on private parameter d (for all one 
knows, k could only depend on public parameter m). This can only be 
detected if one prints the private parameter d in the spec. However, 
this does not say anything about behavior with "non-printed-in-the-spec" 
parameters.

Rene

On 6/4/2015 10:58 AM, Ilari Liusvaara wrote:
> On Thu, Jun 04, 2015 at 10:09:29AM -0400, Rene Struik wrote:
>
>> Note that the signature verification routine already provides virtually all
>> the mechanisms to implement these "self tests", so incremental implementation
>> cost would be virtually zero.
> The problem is that this only catches buggy generation of the signature
> once k is chosen (which one tends to quickly notice anyway, since nothing
> works properly). It does not catch buggy generation of k (which is much harder
> to notice and could easily lead to catastrophic failure).
>
>
> -Ilari


-- 
email: [e-mail] | Skype: rstruik
cell: [phone] | US: [phone]