Re: [Cfrg] Call for adoption draft-mattsson-cfrg-det-sigs-with-noise

[Dan Brown <[e-mail]>]

It seems fine to adopt this, but a few things should be checked.

 

 

Procedurally, randomizing signatures is a *reversal* of CFRG consensus towards determinism, so maybe past discussions on CFRG are worth reviewing (I have forgotten the arguments). Maybe determinism proponents are too busy to check here, and should be briefly queried.

 

https://mailarchive.ietf.org/arch/msg/cfrg/NKiP_VOxTNI6lhukz7BP1Dh5kkk/

https://mailarchive.ietf.org/arch/msg/cfrg/QI6-EXVWtcAwBc6WakKl5YmZZlA/

https://mailarchive.ietf.org/arch/msg/cfrg/76HvHx_wXgIZJDr2COO8xQM8tZA/

 

 

How much side-channel resistance is gained from randomization? A mild gain sounds plausible to me, but I would to defer to side channel experts, e.g., if they think they think it a loss.  Perhaps determinism + side channel exposes the same bits over and over again (e.g. if the signed message is the constant), but randomization + side channel exposes new bits (for a constant message), making randomized more vulnerable?

 

 

I wonder if some applications of signatures now rely on non-standard, off-label properties of signatures, e.g. determinism (or non-determinism for older applications).  (Non-standard here means something 

different from Goldwasser-Micali-Rivest unforgeability against adaptive chosen message attacks.)  For example, maybe EdDSA is somewhere being used like a verifiable hash?  (Ok, any verifier reliance on determinism is probably insecure, because the signer switch over to non-determinism.)

 

​​​​​

Should we continue to name these “deterministic” signatures, if the plan is to make them non-deterministic?  

 

How about message-dependent signatures, since both components of the signature (R,S) will depend on the message? Or message-keyed, to emphase that R must depend on M, not just S.  (Multi-word phrases have precedents, I am reminded of nonce-misuse resistance, thought does not fit here.)

 

I am partly repeating here my past suggestions to CFRG, where I argued that it would be “deterministic” (but insecure!) to always re-use the same ephemeral key (aka nonce, per-message secret).  Hence “deterministic signature” is like naming an armored car, a “heavy car”. 

 

Dan

 

From: Cfrg <[e-mail]> On Behalf Of Stanislav V. Smyshlyaev
Sent: Tuesday, April 28, 2020 7:23 AM
To: CFRG <[e-mail]>
Cc: [e-mail]
Subject: [Cfrg] Call for adoption draft-mattsson-cfrg-det-sigs-with-noise

 

Dear CFRG participants,

This email commences a 2-week call for adoption for draft-mattsson-cfrg-det-sigs-with-noise-02 that will end on May 12th 2020:


https://datatracker.ietf.org/doc/draft-mattsson-cfrg-det-sigs-with-noise/ <https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_doc_draft-2Dmattsson-2Dcfrg-2Ddet-2Dsigs-2Dwith-2Dnoise_&d=DwMFaQ&c=yzoHOc_ZK-sxl-kfGNSEvlJYanssXN3q-lhj0sp26wE&r=qkpbVDRj7zlSRVql-UonsW647lYqnsrbXizKI6MgkEw&m=ydtZz5PC4Sux3jOiCX58oVZerBsDmsFrMLrXoTd40sc&s=2Hv35e8ePak-1MtzQnsFFQG5R1VOOCG1zZHav675APw&e=>   

Please give your views on whether this document should be adopted as a CFRG draft, and if so, whether you'd be willing to help work on it/review it. Please reply to this email (or in exceptional circumstances you can email CFRG chairs directly at [e-mail] <mailto:[e-mail]> ).

Thank you,
Stanislav (for the chairs)

----------------------------------------------------------------------
This transmission (including any attachments) may contain confidential information, privileged material (including material protected by the solicitor-client or other applicable privileges), or constitute non-public information. Any use of this information by anyone other than the intended recipient is prohibited. If you have received this transmission in error, please immediately reply to the sender and delete this information from your system. Use, dissemination, distribution, or reproduction of this transmission by unintended recipients is not authorized and may be unlawful.