search

cfrg / draft-irtf-cfrg-det-sigs-with-noise

Other
1 stars 0 forks source link

Deterministic interface #10

Open emanjon opened 3 months ago

emanjon commented 3 months ago

https://mailarchive.ietf.org/arch/msg/cfrg/jmfn1b880x7-7gZKb7_uwLvE3oU/

Taylor R Campbell wrote: Where does one find test vectors for the deterministic functions defined here with the extra randomization parameters Z?

Daniel Bernstein wrote:

emanjon commented 3 months ago

Bernstein wrote:

https://mailarchive.ietf.org/arch/msg/cfrg/GRigAYvZ8-Z8qmxJ1jOiKR8eLyQ/

Compute SHA-512(dom2(F, C) || Z || prefix || 000... || PH(M)),

What stops implementors from forgetting to include PH(M) in the hash input? I'd recommend building this on top of a deterministic interface where Z is an explicit input, and making sure to test that interface.

emanjon commented 3 months ago

I assume the suggestion here is that the interface is inside of the specification. I.e., the end user calls Sign(sk, M) and the description in the specification is

Sign(sk, M):

  1. Generate random Z
  2. Sign(sk, M, Z)
cjpatton commented 3 months ago

I think this is a good idea.

FiloSottile commented 2 months ago

Big fan of derandomized interfaces, and NIST is planning to introduce them for the PQ algorithms (https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/Mf2kemwwreY/m/oF8HfaNxAQAJ) so I like the idea of a testable Sign_internal(sk, M, Z), but only if it doesn't delay this draft further. I'd like to implement this and produce shared test vectors for it ASAP :)

emanjon commented 2 months ago

Seems to be strong support for specifying a derandomized interface. We will add that.

emanjon commented 2 months ago

I'd like to implement this and produce shared test vectors for it ASAP :) Noted, let's try to move this draft to publications asap. Early comments was mostly about naming and IPR, It is just recently we have gotten a lot of good technical comments, which are very welcome.