Re: [Cfrg] testability of signature input/output parameters

[Derek Atkins <[e-mail]>]

Rene Struik <[e-mail]> writes:

> Hi Ilari:
>
> Just curious about your remark that deterministic signatures would
> allow for easier testability.
>
> I don't know how these tests would exactly look like, but I presume
> these take as input some messages and public keys written in a spec
> and then checking whether the signature output is indeed as listed in
> the spec for the corresponding message/public key pairs {let us assume
> that these test parameters have been confirmed independently, prior to

No, you would publish the *PRIVATE* key, the message, and the signature,
so that you could verify that your implementation generates the exact
same signature given the exact same inputs.

You could theoretically do this with a non-deterministic scheme as well
if you also publish the random nonces along with the private key
parameters.  But having a deterministic signature scheme is better,
IMHO, because frankly some devices don't have a good source of random
numbers.

-derek
-- 
       Derek Atkins                 617-623-3745
       [e-mail]             www.ihtfp.com
       Computer and Internet Security Consultant