Re: [Cfrg] Elliptic Curves - signature scheme: friendliness to low memory implementations (ends on June 3rd)

[Nico Williams <[e-mail]>]

On Wed, May 20, 2015 at 10:16:16PM +0100, Alexey Melnikov wrote:
> #1: The signature scheme should follow the traditional model of hashing
> the message to be signed, thus trivially supporting IUF APIs in
> constant-space, at the cost of requiring collision resistant hash
> functions.
> 
> #2: The signature scheme should not depend on collision resistance, at the
> cost of the signing algorithm having to buffer messages to be signed.
> 
> #3: option #2, but with an additional "large message" mode defined for
> protocols that feel that they need it, where the message to be signed is
> actually a hash of the true message.

I'd rather this be cast in terms of online/offline.  The question isn't
how much memory is needed, but whether the amount needed is fixed or
unbounded (e.g., proportional to message length).

Anyways, I think we should do #4, a rephrasing of #3, though I'm open to
all options listed thus far:

#4: provide both online and not-online signature schemes

Users could use an offline scheme in an online way and hash the message
themselves, but it seems best to do it in the scheme itself.

Nico
--