Re: [Cfrg] A downside of deterministic DL signatures?

[Dan Brown <[e-mail]>]

I was also asking if pre-computing kG is useful as a secondary side-channel 
countermeasure, which occurred to me upon skimming:



http://eprint.iacr.org/2011/232



As I understand the abstract of that paper, the implemented form Montgomery 
ladder was not constant time. This resulted in an exploitable side channel. 
They describe a simple fix.  But in the event of other possible side channels, 
such as those arising from bugs and underlying system quirks (whatever 
acceleration the system tries to provide), does it make sense to use some 
secondary independent side-channel countermeasures?  For example, does 
computing the ECDSA signature component kG at the start of the TLS handshake 
in parallel with other operations, such as the ECDHE computations and so on, 
have any potential help by blurring any timing information?



Best regards,



Dan





From: Tony Arcieri [mailto:[e-mail]]
Sent: Thursday, July 31, 2014 5:09 PM
To: Daniel Kahn Gillmor
Cc: Michael Hamburg; Dan Brown; IRTF Crypto Forum Research Group
Subject: Re: [Cfrg] A downside of deterministic DL signatures?



On Thu, Jul 31, 2014 at 10:23 AM, Daniel Kahn Gillmor <[e-mail]> 
wrote:

neither of these required nationstate-level effort, and they date back

to 2008.



Okay, let me put it this way instead:



Collisions:



- Can be used to alter the content of individual messages

- This requires that the design of the hash function itself be broken



Bad nonces:



- Leak the private key which can then be used to forge as many messages as you 
wish

- Can be the result of bad RNGs/implementation errata even if the algorithm 
and the rest of its implementation is sound



Which is worse?



-- 
Tony Arcieri