Re: [Cfrg] testability of signature input/output parameters

[Rene Struik <[e-mail]>]

I think one lesson one can draw from "piecemeal polls" is that it might 
make it harder to consider system-wide trade-offs.

Hence, the questions in my email of yesterday, June 3, 2015, 5.14pm EDT, 
see http://www.ietf.org/mail-archive/web/cfrg/current/msg06875.html. I 
think these still stand.

Rene

On 6/4/2015 2:36 PM, Nico Williams wrote:
> On Thu, Jun 04, 2015 at 10:09:29AM -0400, Rene Struik wrote:
>> [...]
> It isn't possible to write test vectors for non-deterministic signature
> schemes unless you expose PRNG state or nonce inputs as explicit
> arguments to the API.  Regardless of whether one chooses to do that or
> not, non-deterministic signature schemes whose security falls apart when
> nonces are reused (or are predictable) is a really bad idea.
>
> Anyways, we've already determined that we have consensus in favor of
> deterministic signature schemes.  You could ask that that matter be
> re-opened, but first re-read the threads that led there.
>
> Nico


-- 
email: [e-mail] | Skype: rstruik
cell: [phone] | US: [phone]