Re: [Cfrg] My thoughts on randomized signature generation

[Phillip Hallam-Baker <[e-mail]>]

On Fri, May 8, 2020 at 10:33 AM Sofía Celi <[e-mail]> wrote:

> Hi, Watson and list,
>
> Thanks so much for sending this.
>
> I agree with Watson on the problems that this will introduce, and that
> this have to be taken into account carefully.
>
> I'll also like to raise some doubts around introducing this for RFC8032.
> That RFC specifies already certain security recommendations for
> side-channel leaks and as well as randomness considerations in what
> seems to concern the RFC. The RFC seems also to concern only about the
> algorithm itself, and just expects the private key to be
> cryptographically secure random data, following RFC4086. I haven't
> correctly reviewed RFC4086, but maybe this can be the place to correctly
> define the requirements for randomness, specifically for IoT deployments.
>

Correctly stated, the requirement is for unguessability, not randomness.

That it is random is a necessary but not sufficient condition. It is the
unguessable part that is hard.

One approach that I think lends itself very well is to make use of a KDF
over a device specific secret with the salt input including a counter
value. But for robustness, I would also want a value depending on the key
pair, the purported date time, etc. etc.


At the end of the day, if the attacker knows the initial internal state of
the device and all the communications between the device and the outside
world, they are going to be able to emulate that device.