Re: [Cfrg] testability of signature input/output parameters

[Taylor R Campbell <[e-mail]>]

   Date: Thu, 04 Jun 2015 11:24:18 -0400
   From: Rene Struik <[e-mail]>

   Well, neither do deterministic signatures seem to help here: if one 
   presumes k=f(m,d) and indeed finds that, for fixed public signature key, 
   repeats of message m produce the same signature, this does not 
   necessarily imply that f depends on private parameter d (for all one 
   knows, k could only depend on public parameter m). This can only be 
   detected if one prints the private parameter d in the spec. However, 
   this does not say anything about behavior with "non-printed-in-the-spec" 
   parameters.

How do you write a test vector for signing without including the
signing key?

For a deterministic scheme, test vectors of the form

(secret key, message, signature)

verify correctness of the complete signing operation.

For a nondeterministic scheme, test vectors of the form

(secret key, message, nonce, signature)

verify only correctness of the deterministic part of the signing
operation, and cannot verify correctness of nonce generation.  For
RSASSA-PSS, `nonce' generation is inconsequential for security; for
ECDSA, nonce generation makes or breaks it.