Re: [Cfrg] testability of signature input/output parameters

[Watson Ladd <[e-mail]>]

On Thu, Jun 4, 2015 at 8:24 AM, Rene Struik <[e-mail]> wrote:

> Hi Ilari:
>
> Well, neither do deterministic signatures seem to help here: if one
> presumes k=f(m,d) and indeed finds that, for fixed public signature key,
> repeats of message m produce the same signature, this does not necessarily
> imply that f depends on private parameter d (for all one knows, k could
> only depend on public parameter m). This can only be detected if one prints
> the private parameter d in the spec. However, this does not say anything
> about behavior with "non-printed-in-the-spec" parameters.


No, the spec specifies a function sign(message, private_key) that returns a
signature. Because it specifies the function completely (defines the
function), it's possible to provide message, private_key pairs and require
the output to be a specific form. The functionality tested this way is
exactly the functionality used.


>
>
> Rene
>
> On 6/4/2015 10:58 AM, Ilari Liusvaara wrote:
>
>> On Thu, Jun 04, 2015 at 10:09:29AM -0400, Rene Struik wrote:
>>
>>  Note that the signature verification routine already provides virtually
>>> all
>>> the mechanisms to implement these "self tests", so incremental
>>> implementation
>>> cost would be virtually zero.
>>>
>> The problem is that this only catches buggy generation of the signature
>> once k is chosen (which one tends to quickly notice anyway, since nothing
>> works properly). It does not catch buggy generation of k (which is much
>> harder
>> to notice and could easily lead to catastrophic failure).
>>
>>
>> -Ilari
>>
>
>
> --
> email: [e-mail] | Skype: rstruik
> cell: [phone] | US: [phone]
>
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> http://www.irtf.org/mailman/listinfo/cfrg
>



-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.