Re: [Cfrg] Mishandling twist attacks

["D. J. Bernstein" <[e-mail]>]

Lochter, Manfred writes:
> On the other hand this countermeasure is quite dangerous, when applied
> during signature generation.

No. It's true that minimum-length signature nonces with the high bit set
are dangerous, but minimum-length signature nonces _without_ the high
bit set are _also_ dangerous, so blaming the high bit is unreasonable.

The best protection we know is to generate much longer nonces---such as
the 512-bit nonces in Ed25519. Then the system isn't broken by a timing
attack revealing the nonce length. Setting the high bit of such a long
nonce is also perfectly safe.

Of course, an implementor can still get in trouble by (1) reducing these
nonces and then (2) leaking the lengths of the reduced nonces through a
variable-time scalarmult method. So, as another line of defense, we also
choose curves that support simple, fast, constant-time ladders.

---Dan