Re: [Cfrg] testability of signature input/output parameters

[Watson Ladd <[e-mail]>]

On Thu, Jun 4, 2015 at 1:23 PM, Nico Williams <[e-mail]> wrote:

> On Thu, Jun 04, 2015 at 12:54:40PM -0700, Watson Ladd wrote:
> > Note that verifiers will still accept signatures generated with random k,
> > permitting the avoidance of double hashing while preserving the more than
> > collision property in systems which actually require this.
>
> Right, special-purpose implementations can resort to such optimizations
> because special-purpose implementations are more likely to manage the
> requisite state and/or TRNG.  But for general purpose implementations we
> should have deterministic behavior.
>
> Note also that verification for message-derived k schemes is still
> online (though implementations should generall not permit access to the
> message prior to signature verification).  It's only the signature
> function that is made offline by the CR constructions we've discussed.
>

Let's consider an actual scheme for a moment, namely EdDSA. The verifier
takes R and s, computes e=H(R, M), and determines if R=sG+eP. This only
requires one pass through the message, not two, which for some reason we
are calling "online" vs. "offline".

Why don't we see if anyone has an actual objection to EdDSA, instead of
fooling around trying to repeat this work? It's soon going to be over a
year: I'd like to see a finished product then,


> Nico
> --
>



-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.