Re: [saag] [Cfrg] Recommendations Regarding Deterministic Signatures

[Tony Arcieri <[e-mail]>]

On Wed, Nov 27, 2019 at 3:14 AM John Mattsson <john.mattsson=
[e-mail]> wrote:

> My current view is that best practice seems to be to use deterministic
> algorithms (deterministic ECDSA or EdDSA) with "additional randomness" /
> "noise" like in XEdDSA.


I'll +1 this, but also noting that for existing deterministic signature
algorithms, one potential mitigation for fault injection attacks against
these algorithms (depending on whether circumstances / threat models permit
it) is verifying generated signatures before releasing them.

That doesn't help with the issue of leaking message equivalence, however
I'll also note that some applications of deterministic signatures I work on
personally benefit from the determinism from a fault-tolerance perspective,
as it allows for recomputing a signature on a message which may or may not
have been lost in a protocol where inconsistent signature generation in and
of itself is considered a fault.

-- 
Tony Arcieri