Re: [Hash] randomized hashes and DSA

Steven M. Bellovin <smb@cs.columbia.edu> wrote:

> In message <20050804072610.060AEB813@delta.rtfm.com>, Eric Rescorla writes:
> >Steven M. Bellovin <smb@cs.columbia.edu> wrote:
> >> At the hash BoF, Ran Canetti suggested using the same random number for 
> >> the hash as for the DSA signature.  That left me feeling very uneasy.  
> >> I think I can now show that it's a very bad idea.
> >> 
> >> The problem is that the two have very different properties.  The random 
> >> number used for signing must remain confidential; the random number for 
> >> hashing need only be unpredictable.  If I receive a signed message, in 
> >> order to verify it I need to have the random number to feed to the hash 
> >> function.  But before this, the hash module did not need to have any 
> >> confidentiality properties.  With this scheme, it does.  This imposes a 
> >> signficant new requirement on the modularization of the total system.
> >
> >I was assuming that Ran meant r, which is computed by generating
> >a random k and then computing: (g^k mod p) mod q
> >where k is random and secret. r, however, is public and part of
> >the signature, and random since it was derived from k.
> >
> 
> That would certainly be better, though there are still issues with 
> modularization.  The signing process would no longer be a simple
> pipeline of an hash operator that merely needs to be authentic and a 
> signature operator that requires confidentiality.  To give a concrete 
> example, in a secure email system the signature function -- DSA, RSA, 
> or whatever -- should be in a separate compartment to protect the 
> long-term secret key from the vast bulk of the MTA.  This scheme would 
> complicate the API to the signature function, and require a different 
> API for DSA than for RSA.

Totally agree..

-Ekr

_______________________________________________
Hash mailing list
Hash@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/hash