Re: [Cfrg] Exposing the private key by signing "too many times"

Yes, CFRG should educate.

Standards often have informational sections.  We should include 
references to security proofs in an informational section.   The 
references should point out critical assumptions in each referenced proof.

In addition standards often contain a section on security 
considerations, which gives information on precautions the implementer 
must take to have the actual implementation be secure.   But we could go 
further and cite papers about the vulnerability.  We could also cite 
papers about vulnerabilities for systems similar  to but different from 
the standard, and mention how the standard avoids the vulnerability.

In addition, if things like side channel attacks are relevant, this 
should be mentioned, and the conditions under which the side channel 
attack is relevant should by mentioned.  (For example, timing attacks to 
signing are important if the device is a set-top box in the possession 
of a potential adversary, but would not be relevant to signing code or a 
certificate in an air-gapped secure signing room.)

   --David Jacobson

On 4/14/16 7:44 AM, Dan Brown wrote:
> Long ago DSA allowed biased ephemeral secrets, which Bleichenbacher exploited to extract the private key.
>
> Not aware of history or survey papers on topic, sorry.
>
> Some security proofs may have dependency on number of signatures, but that seems unlikely to lead to a regular belief among 'non-cryptographers'.
>
> Intuitively, such a belief could arise naturally: info-theoretically each signature might leak some new small amount of info about the private key.
>
> Not related to signatures, but there's also Gallant's attack against static DH :)
>
> Is it CFRG's job to educate in such matters?
>
>    Original Message
> From: Paul Hoffman
> Sent: Tuesday, April 12, 2016 9:32 PM
> To: cfrg@irtf.org
> Subject: [Cfrg] Exposing the private key by signing "too many times"
>
>
> Greetings again. I regularly hear from non-cryptographers that they once
> heard that you have to be careful not to sign "too many times" with the
> same public/private pair because doing so will expose the private key.
> I'm interested in the history of this belief. Are there any papers about
> the history of signature algorithms where this might have been true, or
> papers on the history of this belief?
>
> --Paul Hoffman
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>