[CFRG] 答复: I-D Action: draft-irtf-cfrg-det-sigs-with-noise-03.txt

[Niu Danny <[e-mail]>]

From the perspective of the context string feature, I think it’s good - previously I implemented context string using un-finalized hashing context copying, where I feed context string into the hashing context without finalizing it, and copying it for use when signing; draft-03 made me change the way I implement it.

If you can provide a discussion of performance of hashing call counts and compatibility with pre-hash variants, I think it’ll be convincing enough to adopt that in the next draft(s).

发件人: CFRG <[e-mail]> 代表 D. J. Bernstein <[e-mail]>
日期: 星期五, 2024年3月22日 15:08
收件人: [e-mail] <[e-mail]>
主题: Re: [CFRG] I-D Action: draft-irtf-cfrg-det-sigs-with-noise-03.txt
I think the best way to convert deterministic Ed25519 signing software
into randomized Ed25519 signing software is to overwrite noncekey with
H(noncekey,randomness) right after the usual derivation of noncekey from
the secret key, i.e., before computing nonce = H(noncekey,message).

This makes the code changes as simple as possible: for example, the
relevant changes from earlier code to lib25519 replaced

    unsigned char secret[64];
    crypto_hash_sha512(secret,sk,32);

with

    unsigned char secret[96];
    crypto_hash_sha512(secret,sk,32);
    randombytes(secret+64,32);
    crypto_hash_sha512(secret+32,secret+32,64);

and left everything else unchanged.

The main security risk from randomization comes from typical test
frameworks not being able to test randomized functions: basically, the
entire signing function ends up being tested merely for "yes, signatures
verify", so bugs in how nonces are generated won't be caught. Randomized
functions are tested in the lib25519 test framework, and aligning the
randomization details has the secondary advantage of allowing reuse of
test inputs and test outputs from lib25519.

---D. J. Bernstein

_______________________________________________
CFRG mailing list
[e-mail]
https://mailman.irtf.org/mailman/listinfo/cfrg