Re: [Cfrg] A downside of deterministic DL signatures?

[Alyssa Rowan <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 29 July 2014 21:58:47 BST, Dan Brown <[e-mail]> wrote:
>‎In ECDSA or Schnorr, if the ephemeral private key k depends on the
>message bring signed, precomputation of kG, an efficiency advantage
>(reduced latency?), and possibly effective side channel countermeasure
>(harder to time precomputation), seems precluded. Not being an
>efficiency or side channel expert, I ask: Does this downside sound
>right?

On the other hand, deterministic signatures can have test vectors - a big win - and they don't need an RNG. Less baggage, less worry about implementation fingerprinting or even potential kleptography (although obviously you should always avoid black boxes too where that last one could be a risk!).

You also obviously have to store precomputed values around if you choose that (of course you have to keep the key around too, but you're probably not writing that as frequently).

Conversely, you may need to be careful about leaking lengths in deterministic forms like RFC 6979. (Moot if they're visible anyway, but still worthy of mention.)

Deterministic is the most sensible implementation choice. In fact, it's how you SHOULD do it, I think. But having a perfect RNG also works, so I wouldn't on balance make deterministic a MUST: but random k is the most hazardous choice overall, as you're just 2-4 predictable bits away from the precipice of disaster. (...if anyone chooses that route, scrutinise it.)

There's also the hybrid approach chosen by BoringSSL (and current LibReSSL), which depends on RNG and the message. No test vectors possible, but still a hedge against RNG imperfection.

- --
/akr
-----BEGIN PGP SIGNATURE-----
Version: APG v1.1.1

iQI3BAEBCgAhBQJT2BfMGhxBbHlzc2EgUm93YW4gPGFrckBha3IuaW8+AAoJEOyE
jtkWi2t6EGgP/iyQhs8oVALu0FDCS3ygoIQ9esLybYjm6wwf6f7BE6/ZoOuFT/5f
ZOcqh8eeqEhbCV8j+3K8G1a7d5ubf3biN2QkZvq/u5Ka81uzJv48IvOY49LEmVKZ
gCpQhXmIUDKYO9mxMahjBAksWr95XVmOXzSDebD9AiYWXwboIAYZMaempnLsfKkZ
AjAMAnJHOM8aMo60N46LQe2Le2ujLNJVlUjTAt14D9HYfgOsEuZrhMS6y1yWvNQW
eoPcDl+09GiKnVpoxtGMhoOF+rnE83rIX/98tvQrn019o4atqfQ8UuHejKoQAZTE
4gtjXHWLKVoSb6z3L+yLxSdsTd6kFukYPcqsiJJZk4NctOQ7TPSA0iyKE7IM0Sbi
C+paPR/B4QXaFtGT9Y3p4Y6E5t/2bx5j7+gc5RXpc9V2c/3Rd7rfJjfoBAAAGM2E
kNlFgKgMIPSx+IGK/iVimTctbBYH2qmZyz7IoGTtUtMqB3CUbyWsNk80t6r+5HhE
kaDf1p12bGz6Fj156fBBqYgOgQJi+NwQVhz/OSu2EQhg4IGgR6FONIAWOGPbITR3
3tKdHnzaN4ZBF0IilpS2Z2CEpvy0kMrV3E136CCShsVMD5+eaUxaZiaSqRykecHC
uGRl+GFfholRtBZqbdGt4hBB0X5PRIqZZ5dZF6hQqE7qtsjyY2mLGVnU
=egg8
-----END PGP SIGNATURE-----