Re: [MLS] On the Insider Security of MLS

Randomness Improvements for Security Protocols - randomness wrapper, for
use with deterministic signatures

https://tools.ietf.org/html/rfc8937

Does this have the properties you need?

Den mån 26 okt. 2020 13:57Joel Alwen <jalwen@wickr.com> skrev:

> Yeah, EdDSA, and especially (randomized) ECDSA, really aren't ideal
> choices from
> a security perspective. But I think their main advantage over other schemes
> (like XEdDSA) is that they are widely implemented (at production quality)
> and
> even part of various standards (e.g. FIPS) which people have to adhere to.
> For
> MLS that's available implementations are a must. (Thats why MLS doesn't
> use UPKE
> like in rTreeKEM though the security benefits are clear.)
>
> Do you happen to know if there are any alternative schemes with better
> properties (like XEdDSA) that have at least some amount of production
> quality
> implementations?
>
> - Joël
>
> On 23/10/2020 12:36, Paul Rösler wrote:
> > Hi Joël,
> >
> > this sounds indeed promising and interesting! One point on the security
> > of EdDSA:
> >
> > On 23.10.20 12:00, Joel Alwen <jalwen@wickr.com> wrote:
> >>  2) ECDSA vs. EdDSA : We found that we could have proven stronger
> security if
> >> only EdDSA were used vs. if ECDSA is permitted. ECDSA sigs produced
> with a bad
> >> PRNG (i.e. not enough entropy) can result in sigs that reveal the
> signing keys.
> >> EdDSA signatures are deterministic and so aren't susceptible to this.
> ECDSA can
> >> also be de-randomized (RFC 6979) to avoid the problem.
> >
> > While EdDSA (and deterministic ECDSA) is not vulnerable to weak
> > randomness, it can be attacked equally devastatingly via fault attacks
> > (e.g., bit flips), which we demonstrate in [2]. Since attacks against
> > randomness and bit flips during signing can both be practical, a
> > compromise between the benefits of both signing variants, like XEdDSA,
> > could probably fit better.
> >
> > Cheers,
> > Paul
> >
> > [2] Attacking Deterministic Signature Schemes using Fault Attacks.
> > Poddebniak, Somorovsky, Schinzel, Lochter, Rösler.
> > https://eprint.iacr.org/2017/1014.pdf
> >
>
> _______________________________________________
> MLS mailing list
> MLS@ietf.org
> https://www.ietf.org/mailman/listinfo/mls
>