Re: [Cfrg] Elliptic Curves - signature scheme: randomised or not (ends on May 13th)

[Ilari Liusvaara <[e-mail]>]

On Mon, May 04, 2015 at 09:16:45AM -0700, Michael Hamburg wrote:
> 
> I also agree that CFRG should specify a derandomized signature algorithm.
> But since it does not harm interoperability (or security if done right),
> we should not absolutely require the nonce to be computed in the way we
> specify.  We should allow a different PRF to be substituted, because for
> example HMAC-SHA2 is a nightmare to blind against DPA.  We should allow
> the use of random nonces: if not in TLS, then in low-latency
> environments like v2v where pregenerated signature coupons could be
> a big win.

Regarding coupon generation: Derandomization can be used to turn
the "nonce" with extreme randomness requirements into true nonce.
It may still be random, but needs only be random enough to be
unique, not to be quasi-perfectly random.


-Ilari