Re: [Cfrg] testability of signature input/output parameters

[Yoav Nir <[e-mail]>]

> On Jun 4, 2015, at 7:59 PM, Derek Atkins <[e-mail]> wrote:
> 
> Rene Struik <[e-mail]> writes:
> 
>> Hi Ilari:
>> 
>> Just curious about your remark that deterministic signatures would
>> allow for easier testability.
>> 
>> I don't know how these tests would exactly look like, but I presume
>> these take as input some messages and public keys written in a spec
>> and then checking whether the signature output is indeed as listed in
>> the spec for the corresponding message/public key pairs {let us assume
>> that these test parameters have been confirmed independently, prior to
> 
> No, you would publish the *PRIVATE* key, the message, and the signature,
> so that you could verify that your implementation generates the exact
> same signature given the exact same inputs.
> 
> You could theoretically do this with a non-deterministic scheme as well
> if you also publish the random nonces along with the private key
> parameters.  But having a deterministic signature scheme is better,
> IMHO, because frankly some devices don't have a good source of random
> numbers.

I agree. Additionally, that test with provided nonces forces you to have aa special test path in your code.

Normally, your cryptographic library wouldn’t expose to the user that it is using random input. Consider OpenSSL’s ECDSA signing function:
  ECDSA_SIG*     ECDSA_do_sign(const unsigned char *dgst, int dgst_len, EC_KEY *eckey);

Internally this function calls whatever random number generator is either part of the library or used by it, but the user doesn’t need to worry about it.

Once you have the need to test, you need a new function. OpenSSL has that as well:
  ECDSA_SIG*     ECDSA_do_sign_ex(const unsigned char *dgst, int dgstlen, 
                        const BIGNUM *kinv, const BIGNUM *rp,
                        EC_KEY *eckey);

The application doesn’t call this second function. It calls the first function. So you’re testing a function that is different from the one that you are testing.

That’s an artifact of having to test randomized signatures. There is no equivalent for, say, RSA.

Yoav

P.S. Yes, I know that the first function just calls the second function, and that the second function generates randoms if kinv and rp are NULL. But this expanded API would not exist if not for the need of testing.