[Cfrg] Schnorr just as vulnerable to bad RNG

[Dan Brown <[e-mail]>]

‎In the SAAG meeting yesterday, it was suggested that Schnorr signatures better resist bad RNG than ECDSA, citing a flawed ECDSA implementation. 

Just like (EC)DSA, if the ephemeral key is exposed or repeated, then the Schnorr static key is exposed, which then can lead to forgery.

So this one implementation failure is not a reason to prefer Schnorr signatures, as an algorithm. 

The importance of proper ephemeral key generation is why ANSI‎ X9.62-2005 for ECDSA added a requirement (not in the1998 version) that the ephemeral key be generated using HMAC DRBG and that it be properly seeded, or else use another ANSI approved RNG. The 1998 version instead said something like unique and unpredictable. 

Some people propose using deriving the ephemerals from the message and a long term key. This does not seem any better as an algorithm than the DRBG approach, provided the X9.62 algorithm is adhered to.

There's an RFC melding both these ideas, but that is trying fix something that is not broken, at the algorithm level.

If a flawed implementation uses a DRBG in compliance with X9.62-2005, but fails to update DRBG state fails between signed messages‎, then the signing key is leaked. If a flawed implementation opts to also use deterministic ephemeral keys for encryption, then repeated messages leak info via repeated ciphertexts.  So, standards should amply warn implementers if these pitfalls. 

So I think there are issues with ease of implementation, clarity of standards, and making standards  error resistant, but the algorithm security is not significant.

In theory, some security proofs, may give different assurances, depending on the determinism, but I'll defer that issue to future discussion. 

‎Procedurally, I think signature algorithm choice, and method to generate ephemerals is a CFRG issue, not a SAAG issue.

Best regards, 

-- Dan