Re: [Cfrg] Deterministic signatures, revisit?

[Ilari Liusvaara <[e-mail]>]

On Tue, Oct 10, 2017 at 10:23:31AM +0000, Dan Brown wrote:
> ‎http://ia.cr/2017/890 gives a theoretical reason to prefer
> deterministic signatures: some proofs work better. So, my
> question goes to side channels (and subversion too, but less so)
> which is better at resisting them, deterministic or one of these
> tweaks in the 2 eprints below?

I think it depends...

There are environments that do not have to care about fault attacks
as long as the algorithm does not leak the key with random faults
(*cough* RSA-CRT *cough*), e.g. stuff running on general purpose
operating systems. However, such environments might very well care
about other side channels like cache attacks. The value of defenses
proposed by the paper for this are somewhat doubtful, altough those
defenses would prevent trying to repeatedly scan r with the same
message to sign (but proper constant-time algorithm would take care of
that as well).

Then there are environments that do care about fault attacks, like
smartcards. These environments usually care about side channels such as
timing and power analysis too. However, the sensitive parts are
elsewhere, needing additional randomization beyond what was proposed in
these papers.



-Ilari