Re: [Cfrg] Elliptic Curves - signature scheme: randomised or not (ends on May 13th)

[Ilari Liusvaara <[e-mail]>]

On Wed, May 06, 2015 at 01:35:11AM -0700, Andrey Jivsov wrote:
> 
> I second the problem with #2 that it's not cryptographically enforceable and
> it limits some performance optimizations. Therefore, SHOULD is fine, but
> prohibiting random bytes instead of specific DRBG is overkill. TLS1.2
> currently requires access to plenty of random/pseudorandom bytes, for
> example.

Except there are random numbers and there are random numbers.

What happens in practice if you feed slightly bad random numbers
into...
a) TLS nonces?
b) TLS DHE private keys?
c) TLS Encrypted premaster secrets?
d) TLS RSA signatures?
e) TLS non-RSA deterministic signature tweaks?
f) TLS non-RSA signture random r's?

Answers:
a) Nothing.
b) Nothing.
c) Nothing.
d) Nothing.
e) Nothing.
f) Signature key compromised pretty quickly, all active security
   lost.


-Ilari