Re: [Cfrg] Elliptic Curves - signature scheme: randomised or not (ends on May 13th)

[Andy Lutomirski <[e-mail]>]

On May 3, 2015 4:15 AM, "Alexey Melnikov" <[e-mail]> wrote:
>
> CFRG chairs are starting discussion of the next topic.
>
> The consensus view of the mailing list was that NIST compliance of our
selected
> signature scheme is not necessary, opening up the opportunity for us to
> consider a rich class of signature schemes beyond ECDSA.
>
> Most if not all signature schemes defined over elliptic curves can be
> de-randomised by generating the "random" value used during signing in a
> pseudorandom manner from the message to be signed. This ameliorates some
> catastrophic failure modes for these schemes. The generation could involve
> using a PRF such as HMAC with a key designed solely for this purpose
> (resulting in an augmented private (signing) key). An alternative could be
> to hash a string consisting of a concatenation of the private (signing)
> key with the message to be signed. There are other possibilities too.
> Several methods are described in detail in RFC 6979
> (http://tools.ietf.org/html/rfc6979).
>
> To determine the way forward, we are going to conduct a poll to determine
> how we should tackle the question of de-randomisation. Please pick one of
the
> options specified below:
>
> 1. CFRG should stick to randomised signature schemes only.
>
> 2. CFRG should adopt deterministic signature scheme only.
>
> 3. De-randomisation should be an optional feature for implementers to
> decide upon (i.e. both choices 1 and 2 allowed).

You left out 4: schemes that are secure without random input but that
nonetheless accept random input.  These could work like derandomized
schemes but with an extra input to the hash.

My preference order would be 2, 4, 3, 1.  Some people want random
signatures for what I consider to be strange reasons.  4 should satisfy
them, and test vectors could verify that they aren't omitting the hash.

--Andy