Re: [Cfrg] testability of signature input/output parameters

[Ilari Liusvaara <[e-mail]>]

On Thu, Jun 04, 2015 at 03:21:33PM -0400, Rene Struik wrote:
> I think one lesson one can draw from "piecemeal polls" is that it might make
> it harder to consider system-wide trade-offs.
> 
> Hence, the questions in my email of yesterday, June 3, 2015, 5.14pm EDT, see
> http://www.ietf.org/mail-archive/web/cfrg/current/msg06875.html. I think
> these still stand.

Going through briefly.

- Randomly generating k in Schnorr is very dangerous. And the dangers go
  far beyond testability.
- One can do deterministic one-pass Schnorr at cost of requiring nonces
  (the usual definition, not the bizarro one ECDSA uses).
- However, I think that is still too dangerous for main mode.
- The message size argument is that since verification is not streamable,
  and thus large message cause pain for verifiers, let's also cause pain
  for signers in order to keep those message sizes in check.


-Ilari