Re: [Cfrg] A downside of deterministic DL signatures?

[Robert Ransom <[e-mail]>]

On 7/29/14, Alyssa Rowan <[e-mail]> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> On 29 July 2014 21:58:47 BST, Dan Brown <[e-mail]> wrote:
>>‎In ECDSA or Schnorr, if the ephemeral private key k depends on the
>>message bring signed, precomputation of kG, an efficiency advantage
>>(reduced latency?), and possibly effective side channel countermeasure
>>(harder to time precomputation), seems precluded. Not being an
>>efficiency or side channel expert, I ask: Does this downside sound
>>right?
>
> On the other hand, deterministic signatures can have test vectors - a big
> win - and they don't need an RNG. Less baggage, less worry about
> implementation fingerprinting or even potential kleptography (although
> obviously you should always avoid black boxes too where that last one could
> be a risk!).

Exactly.  I would make deterministic signatures a MUST for any
interoperable long-term signing key, and make an interoperable
deterministic signature generation specification and interoperable
storage/transport format for the associated secret key material a must
for any signature scheme specification.

For *short-term* signing keys which will never be written to disk, it
may make sense to store a counter along with the secret key, and use
that to precompute ephemeral keys for non-deterministic signature
generation.  (I've considered this as part of a key-agreement
protocol.)  But I can't support this approach for any key which may be
written to disk, or which may need to be used in more than one
signature-generation implementation.


Robert Ransom