Re: [Cfrg] Deterministic signatures, revisit?

[Ilari Liusvaara <[e-mail]>]

On Mon, Oct 09, 2017 at 10:30:19AM -0700, Tony Arcieri wrote:
> This certainly keeps coming up. Beyond those papers see the previous "Side
> channel attack and Edwards curves" thread on this list:
> 
> https://mailarchive.ietf.org/arch/msg/cfrg/V1JXfnf05uE88huYaQVKi7iZ6mY
> 
> I think it's definitely a problem that needs to be addressed. I've seen
> various proposals to do so as well, i.e. synthesizing "r" as a combination
> of a random nonce and the message, so that fault attacks would, at the very
> least, require an RNG failure as opposed to always being possible, due to
> repeated "r" values for the same message. This should retain the extant
> defense against RNG failures in general as we saw with ECDSA "k" values,
> since it would still include hashing the message as part of the calculation.

The latter (2017/985) paper in original message seemingly proposed a
countermeasure of that type. The description of countermeasure was not
completely clear, but I _think_ they proposed adding 768 random bits
between prefix and message in calculation of r.

This change would not break compatiblity (the verifier never sees how
r was generated), and if the random bits are bad, the scheme would not
break catastrophically (can not predict r even if all this entropy was
known).

However, it would expose the scheme to additional kleptographic
attacks. An ability to influence the random numbers used would be
enough to compromise the private key.


-Ilari