Generic signatures

Author: sander

draft-dijkhuis-cfrg-hdkeys.md

@@ -393,6 +393,46 @@ Step 4 MAY be postponed to be combined with step 6. Steps 5 to 8 MAY be combined
 
 # Generic HDK instantiations
 
+## Using digital signatures
+
+Instantiations of HDK using digital signatures require the following cryptographic constructs:
+
+- `DSA`: A digital signature algorithm , consisting of the functions:
+  - Sign(sk, msg): Outputs the signature created using private signing key `sk` over byte string `msg`.
+  - Verify(signature, pk, msg): Outputs whether `signature` is a signature over `msg` using public verification key `pk`.
+
+Using these constructs, an example proof of possession protocol is:
+
+~~~
+# 1. Unit shares with reader: pk
+
+# 2. Reader computes:
+nonce = generate_random_nonce() # out of scope for this spec
+
+# 3. Reader shares with unit: nonce
+
+# 4. Unit computes:
+msg = create_message(pk, nonce) # out of scope for this spec
+signature = Sign(sk, msg)
+
+# 5. Reader computes:
+msg = create_message(pk, nonce) # out of scope for this spec
+Verify(signature, pk, msg)
+~~~
+
+By design of `BL`, the same proof of possession protocol can be used with blinded key pairs and BlindSign, in such a way that the reader does not recognise that key blinding was used.
+
+An instantiation using `DSA` intantiates the following:
+
+~~~
+def BlindSign(sk, bf, msg):
+    sk' = BlindPrivateKey(sk, bf)
+    signature = Sign(sk', msg)
+    return signature
+~~~
+
+- [I-D.draft-irtf-cfrg-signature-key-blinding-07]
+
 ## Using elliptic curves
 
 Instantiations of HDK using elliptic curves require the following cryptographic constructs:
@@ -529,8 +569,6 @@ Such instantiations of HDK use EC additive blinding (see [Using EC additive blin
 - `DSA`: An EC digital signature algorithm , consisting of the functions:
   - Sign(sk, msg): Outputs the signature `(c, r)` created using private signing key `sk` over byte string `msg`.
   - Verify(signature, pk, msg): Outputs whether `signature` is a signature over `msg` using public verification key `pk`.
-  - Serialize(c, r): Outputs the byte array serialization of the signature `(c, r)`.
-  - Deserialize(bytes): Outputs the signature `(c, r)` represented by byte string `bytes`.
 
 Using these constructs, an example proof of possession protocol is:
 
@@ -610,7 +648,7 @@ This instantiation uses ECDH for proof of possession (see [Using ECDH shared sec
 
 This instantiation uses ECDSA for proof of possession (see [Using ECDSA signatures](#using-ecdsa-signatures)) and ECDH for `KEM`.
 
-- `ID`: `"HDK-ECSDSA-P256-v1"`
+- `ID`: `"HDK-ECDSA-P256-v1"`
 - `Ns`: 32
 - `H`: SHA-256 [FIPS180-4] with:
   - `H(msg)`: Implemented by computing `H(ID || msg)`.