Re: [Cfrg] Recommendations Regarding Deterministic Signatures

[Phillip Hallam-Baker <[e-mail]>]

On Fri, Dec 20, 2019 at 3:02 PM Scott Fluhrer (sfluhrer) <[e-mail]>
wrote:

> As far as an RFC8032-compatible threshold signature scheme, it would
> appear to be fairly easy to do, as long as:
>
>
>
>    - You don’t mind not following the precise algorithm in RFC8032, but
>    want something that generates signatres that is computationally
>    indisguishable from RFC8032 signatures.
>    - You don’t mind it if the algorithm is nondetermanistic (that is,
>    signing the same message twice, with different subsets of signers, yields
>    different signatures).
>
>
>
> The public keys and the verification process are completely RFC8032.
>
>
>
> To be frank, this is simple enough that I would be rather surprised if it
> wasn’t already published.  However, if people are interested, I will write
> it up…
>

I certainly think it would be of interest. I am not at all bothered about
strict conformance with RFC8032. If the aggregate signature will verify
correctly with legacy code, that is good enough. We would probably want to
introduce new algorithm identifiers. But we might well want to have a
nondeterministic variant of RFC8032 in any case.

The big concern that I would have is the risk that the aggregate sig
contributions might end up disclosing one of the private keys or providing
sufficient information to allow a forgery of an RFC8032 or other sig.

And then the second order concern is how to convince folk who are not deep
in crypto that the scheme is not going to break something.