Re: [Cfrg] Call for adoption draft-mattsson-cfrg-det-sigs-with-noise

Phillip Hallam-Baker <> Fri, 15 May 2020 04:48 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 0A9D93A0912 for <>; Thu, 14 May 2020 21:48:29 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.398
X-Spam-Status: No, score=-1.398 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.25, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.25, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 67_u_Q6TZjft for <>; Thu, 14 May 2020 21:48:26 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id BCE6D3A090D for <>; Thu, 14 May 2020 21:48:26 -0700 (PDT)
Received: by with SMTP id 19so1131956oiy.8 for <>; Thu, 14 May 2020 21:48:26 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=OEfJUxW0fWTNmoxF7YGX+988lY/Vt+vSaQXDLvlu0/o=; b=uUrwY2bpOqJnzp+o3HBsiBbfMckgWNT0eG61oiVy8qck6qcOwnBEKu9qZfPUESPpKO k1pVP2y5DaZhTIrShu6nkV76Bu3peIP2HwZL4ym/I/32fXeKx1nVvxqLe7mPodKPmXiZ /3G0RQeFNMuXH0LVztzg0Uy7JvQ7sMHdBbw0LfXnibdTfQUcdwYrSaC6euubNDcUMS/c RTAsrw/qSz6j2zg3AV98Nxo/iet0wdBhpfSVKYGgOikqA0wRAbDqRzPDFTxQCsOR2948 D11Slf7JcWEwW0zxHyPZhs72kgDnr8HgRu353gUwcsJ52SUwkYDSea0LsZTP39byYDpE 2y/Q==
X-Gm-Message-State: AOAM5319oa5astj6xaKN7ojx/XMMzKI887FRnyJu/i+NBGwgw9z/cRKD gHJXJhAqFFT7c6Q5jWv9xhtecZr5Qidgp/ZgSo8=
X-Google-Smtp-Source: ABdhPJw6cAy3HjEICSh7Iny58XBNN+C1kEkYNIfCJtAN78Jo52vtHrCzmHQtmjfUUqeVY9wxrqAcDUfMZu68TofseMU=
X-Received: by 2002:aca:b6c2:: with SMTP id g185mr940309oif.166.1589518105849; Thu, 14 May 2020 21:48:25 -0700 (PDT)
MIME-Version: 1.0
References: <>
In-Reply-To: <>
From: Phillip Hallam-Baker <>
Date: Fri, 15 May 2020 00:48:15 -0400
Message-ID: <>
To: "Stanislav V. Smyshlyaev" <>
Cc: CFRG <>,
Content-Type: multipart/alternative; boundary="0000000000001032a505a5a886e4"
Archived-At: <>
Subject: Re: [Cfrg] Call for adoption draft-mattsson-cfrg-det-sigs-with-noise
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Crypto Forum Research Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 15 May 2020 04:48:30 -0000

I support this work and I am willing to review.

There are advantages to a deterministic approach but also some drawbacks
beyond the side channel attack mitigation.

The big downside to a non deterministic scheme is that once the sig scheme
is non deterministic, it becomes impossible to audit a sealed HSM. But I
still think it is useful to describe a process for determining k from a set
of inputs that include a random nonce value, a secret value and some value
that depends on the public key pair that is used.

This is about closing the unintended side channel from the HSM and that is
important. But there is also the intentional side channel attack in which
the HSM vendor intends to leak the key. If the attacker knows the messages
that are signed and their signatures, they can leak the key one bit at a
time by generating multiple values for k and picking an R value that has
particular properties.

So if you want belt and braces, you also want a threshold signature scheme.
But not (alas) the single pass version I am currently using. You need to
get a commitment on R before the HSM sees the message digest to be signed.

On Tue, Apr 28, 2020 at 7:23 AM Stanislav V. Smyshlyaev <>

> Dear CFRG participants,
> This email commences a 2-week call for adoption for draft-mattsson-cfrg-det-sigs-with-noise-02
> that will end on May 12th 2020:
> Please give your views on whether this document should be adopted as a
> CFRG draft, and if so, whether you'd be willing to help work on it/review
> it. Please reply to this email (or in exceptional circumstances you can
> email CFRG chairs directly at
> Thank you,
> Stanislav (for the chairs)
> _______________________________________________
> Cfrg mailing list