Re: [openpgp] Disadvantages of Salted Signatures

[Stephen Farrell <[e-mail]>]

Hiya,

On 10/12/2023 13:46, Stephan Verbücheln wrote:

> However, after reading various threads, it all came down back to the 
> fault attack.

Well, s/attack/attacks/ as there're a bunch of different ones,
but I'd basically agree.

> What I am missing is a balanced discussion about the costs and 
> benefits of deterministic vs. salted signatures in the PGP use case.
Right, that'd be interesting. For the lake WG I think it's an
important aspect that, if edhoc sees wide deployment, many of
the devices concerned would be "commercial" grade and servers.
Applications using openpgp likely experience a different menu
of risks, e.g. I'd imagine co-tenant side-channel attacks would
be much more relevant here.

All that said, in that discussion, we should bear in mind that
the liklihood that we change or re-open crypto-refresh is small,
and that should be the case, unless we find some show-stopper
issue. FWIW, I don't think this is one such.

Cheers,
S.