Re: [Cfrg] call for review: Deterministic Usage of DSA and ECDSA Digital Signature Algorithms

["David W. Kravitz" <[e-mail]>]

Kevin,

 

Regarding "If the report is signed with an RSA signature, even the signature
stays constant.," this gets us back to the issue I mentioned in my initial
comments on the I-D regarding side-channel attacks. See, for example,
"Weaknesses in Current RSA Signature Schemes," Juliane Kramer Dmitry
Nedospasov Jean-Pierre Seifert, ICISC 2011, http://nedos.net/icisc2011.pdf,
which exploits constant (and therefore fixed-per-message-) RSA signature
padding. Also, http://www.rsa.com/rsalabs/node.asp?id=2005 mentions that
"Another advantage of RSA-PSS is that, due to the randomization, an attacker
does not know in advance what the encoded message EM will be. This makes
"fault analysis" attacks of the sort proposed by Bellcore a few years ago
more difficult to mount (see the RSA Laboratories' Bulletin No. 5)."

 

Thanks,
David

 

From: Igoe, Kevin M. [mailto:[e-mail]] 
Sent: Tuesday, September 25, 2012 2:12 PM
To: 'Dan Brown'; 'David W. Kravitz'; [e-mail]
Cc: [e-mail]; [e-mail]; [e-mail]
Subject: RE: [Cfrg] call for review: Deterministic Usage of DSA and ECDSA
Digital Signature Algorithms

 

Can somebody please articulate the benefit of the feature of having the same
signature per message?  Perhaps the I-D itself should elaborate on this
point. Is it just that some protocol picked some signature scheme with this
deterministic feature, and then the protocol decided to rely on this
feature, e.g. by using the signature as an stable index for the message?  

 

I'll give this a shot.  Warning: this is all based on a side comment thrown
into a 

conversation concerning obstacles to the adoption of ECDSA signatures.  It
concerns 

BGPsec, which I believe falls under the SIDR WG.

 

BGP will often get duplicate reports from a given neighbor  because the
local configuration 

hasn't changed since the last report.  If the report is signed with an RSA
signature, even the

signature stays constant, so it's simple to see this is the same message is
the same as the last one

& there is no need to verify any signature.  But using ECDSA, the signature
field will (potentially) 

change even if nothing else has, forcing a signature verification.

 

One way to side step the issue is to use deterministic ECDSA.  Another would
be for the sender to 

keep track of the last signed report it sent and, if nothing has changed,
resend the same report.   

 

(I haven't paid much attention to the current state of the BGPsec
discussions and its threat models, but 

a priori I think I'd  want a timestamp of some sort to prevent replay. That
would mean that the report 

would always be changing and a signature verification would always need to
be done).

 

Again, this is all of this is second or third hand,  a quick glance at the
SIDR mailing list didn't provide any 

relevant information.