Re: [Hash] randomized hashes and DSA

Steven M. Bellovin <smb@cs.columbia.edu> wrote:
> At the hash BoF, Ran Canetti suggested using the same random number for 
> the hash as for the DSA signature.  That left me feeling very uneasy.  
> I think I can now show that it's a very bad idea.
> 
> The problem is that the two have very different properties.  The random 
> number used for signing must remain confidential; the random number for 
> hashing need only be unpredictable.  If I receive a signed message, in 
> order to verify it I need to have the random number to feed to the hash 
> function.  But before this, the hash module did not need to have any 
> confidentiality properties.  With this scheme, it does.  This imposes a 
> signficant new requirement on the modularization of the total system.

I was assuming that Ran meant r, which is computed by generating
a random k and then computing: (g^k mod p) mod q
where k is random and secret. r, however, is public and part of
the signature, and random since it was derived from k.

-Ekr

_______________________________________________
Hash mailing list
Hash@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/hash