Re: [Cfrg] A downside of deterministic DL signatures?

[Michael Hamburg <[e-mail]>]

On Jul 30, 2014, at 12:30 PM, Robert Ransom <[e-mail]> wrote:

> On 7/29/14, Alyssa Rowan <[e-mail]> wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA512
>> 
>> On 29 July 2014 21:58:47 BST, Dan Brown <[e-mail]> wrote:
>>> ‎In ECDSA or Schnorr, if the ephemeral private key k depends on the
>>> message bring signed, precomputation of kG, an efficiency advantage
>>> (reduced latency?), and possibly effective side channel countermeasure
>>> (harder to time precomputation), seems precluded. Not being an
>>> efficiency or side channel expert, I ask: Does this downside sound
>>> right?
>> 
>> On the other hand, deterministic signatures can have test vectors - a big
>> win - and they don't need an RNG. Less baggage, less worry about
>> implementation fingerprinting or even potential kleptography (although
>> obviously you should always avoid black boxes too where that last one could
>> be a risk!).
> 
> Exactly.  I would make deterministic signatures a MUST for any
> interoperable long-term signing key, and make an interoperable
> deterministic signature generation specification and interoperable
> storage/transport format for the associated secret key material a must
> for any signature scheme specification.
> 
> For *short-term* signing keys which will never be written to disk, it
> may make sense to store a counter along with the secret key, and use
> that to precompute ephemeral keys for non-deterministic signature
> generation.  (I've considered this as part of a key-agreement
> protocol.)  But I can't support this approach for any key which may be
> written to disk, or which may need to be used in more than one
> signature-generation implementation.
> 
> 
> Robert Ransom

Why not make it a SHOULD in the signature standard, and then other standards can upgrade it to MUST if they don’t need low-latency or streaming signatures?

— Mike