[CFRG] 回复: I-D Action: draft-irtf-cfrg-det-sigs-with-noise-03.txt

[Niu Danny <[e-mail]>]

To be honest, I'm quite frusterated with the progress of this draft, and its content, which in my opinion is sort of over-design.

Since neither the previous RFC6979 nor the current draft or its any possible future formalization are "normative" according to anyone, I'm adopting the construct from djb in his mailarchive.ietf.org/arch/msg/cfrg/R7tUulCdBh9wHMVaCsr-ho-Xi9I/ message, on my master branch.

I'll retain the branch tracking the current development in case of any future development.

________________________________________
发件人: CFRG <[e-mail]> 代表 D. J. Bernstein <[e-mail]>
发送时间: 2024年3月22日 15:08
收件人: [e-mail]
主题: Re: [CFRG] I-D Action: draft-irtf-cfrg-det-sigs-with-noise-03.txt

I think the best way to convert deterministic Ed25519 signing software
into randomized Ed25519 signing software is to overwrite noncekey with
H(noncekey,randomness) right after the usual derivation of noncekey from
the secret key, i.e., before computing nonce = H(noncekey,message).

This makes the code changes as simple as possible: for example, the
relevant changes from earlier code to lib25519 replaced

    unsigned char secret[64];
    crypto_hash_sha512(secret,sk,32);

with

    unsigned char secret[96];
    crypto_hash_sha512(secret,sk,32);
    randombytes(secret+64,32);
    crypto_hash_sha512(secret+32,secret+32,64);

and left everything else unchanged.

The main security risk from randomization comes from typical test
frameworks not being able to test randomized functions: basically, the
entire signing function ends up being tested merely for "yes, signatures
verify", so bugs in how nonces are generated won't be caught. Randomized
functions are tested in the lib25519 test framework, and aligning the
randomization details has the secondary advantage of allowing reuse of
test inputs and test outputs from lib25519.

---D. J. Bernstein

_______________________________________________
CFRG mailing list
[e-mail]
https://mailman.irtf.org/mailman/listinfo/cfrg