Re: [Cfrg] Call for adoption draft-mattsson-cfrg-det-sigs-with-noise

I support this work and I am willing to review.

There are advantages to a deterministic approach but also some drawbacks
beyond the side channel attack mitigation.

The big downside to a non deterministic scheme is that once the sig scheme
is non deterministic, it becomes impossible to audit a sealed HSM. But I
still think it is useful to describe a process for determining k from a set
of inputs that include a random nonce value, a secret value and some value
that depends on the public key pair that is used.

This is about closing the unintended side channel from the HSM and that is
important. But there is also the intentional side channel attack in which
the HSM vendor intends to leak the key. If the attacker knows the messages
that are signed and their signatures, they can leak the key one bit at a
time by generating multiple values for k and picking an R value that has
particular properties.

So if you want belt and braces, you also want a threshold signature scheme.
But not (alas) the single pass version I am currently using. You need to
get a commitment on R before the HSM sees the message digest to be signed.

On Tue, Apr 28, 2020 at 7:23 AM Stanislav V. Smyshlyaev <smyshsv@gmail.com>
wrote:

> Dear CFRG participants,
> This email commences a 2-week call for adoption for draft-mattsson-cfrg-det-sigs-with-noise-02
> that will end on May 12th 2020:
>
> https://datatracker.ietf.org/doc/draft-mattsson-cfrg-det-sigs-with-noise/
>
>
> Please give your views on whether this document should be adopted as a
> CFRG draft, and if so, whether you'd be willing to help work on it/review
> it. Please reply to this email (or in exceptional circumstances you can
> email CFRG chairs directly at cfrg-chairs@ietf.org).
>
> Thank you,
> Stanislav (for the chairs)
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>