Re: [Cfrg] Exposing the private key by signing "too many times"

I think the concern isn't a crypto concern but an implementation concern. There's folklore knowledge of side-channel attacks, and folklore belief that every time you use the key it's vulnerable to a software attack. Root CA keys are airgapped because every time they're brought online there's a risk they are used to sign something they shouldn't. So this isn't a threat that can be addressed by looking at details of particular algorithms, it's to do with key usage.

It does seem like common sense that the longer a key's life, the greater the risk that it gets compromised while active, so having some key rollover policy is probably good practice.

Cheers,

William

On April 13, 2016 at 1:06:15 AM, Manger, James (james.h.manger@team.telstra.com) wrote:

Sign "too many times" and you might be the victim of an adaptive chosen-ciphertect attack, a la Bleichenbacher's million message attack. That doesn't expose the private RSA key, but it does expose a symmetric session key encrypted for that key. This might contribute to the belief you mention. 

-- 
James Manger 

-----Original Message----- 
From: Cfrg [mailto:cfrg-bounces@irtf.org] On Behalf Of Paul Hoffman 
Sent: Wednesday, 13 April 2016 11:32 AM 
To: cfrg@irtf.org 
Subject: [Cfrg] Exposing the private key by signing "too many times" 

Greetings again. I regularly hear from non-cryptographers that they once 
heard that you have to be careful not to sign "too many times" with the 
same public/private pair because doing so will expose the private key. 
I'm interested in the history of this belief. Are there any papers about 
the history of signature algorithms where this might have been true, or 
papers on the history of this belief? 

--Paul Hoffman 

_______________________________________________ 
Cfrg mailing list 
Cfrg@irtf.org 
https://www.irtf.org/mailman/listinfo/cfrg 

_______________________________________________ 
Cfrg mailing list 
Cfrg@irtf.org 
https://www.irtf.org/mailman/listinfo/cfrg 