Subject: [Cfrg] suffix+IUF+"det" sigs

From: Dan Brown <[email-masked]>
Date: Sat, 20 Jun 2015 12:28:36 +0000

‎More details about my previous proposal...

option a) signer computes two hash streams simultaneously: eg r=HMAC(k,M) for some key k and e=SHA-2(M | rG). Signature is rG, s where is by some formula TBD.

option b) signer ‎computes one hash long hash stream, for SHA-3(M|rG), but pauses at M, and derives r from some intermediate value in the SHA-3 computation. Signature as above.

in both options, the verifier need only hash M|rG with no tricks.

Neither's perfect... surely someone has considered something similar...

Sent from my BlackBerry 10 smartphone on the Rogers network.