Subject: [CFRG] I-D Action: draft-mattsson-cfrg-det-sigs-with-noise-04.txt

From: [email-masked]
Date: Tue, 15 Feb 2022 05:54:05 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Crypto Forum RG of the IRTF.

        Title           : Deterministic ECDSA and EdDSA Signatures with Additional Randomness
        Authors         : John Preuß Mattsson
                          Erik Thormarker
                          Sini Ruohomaa
	Filename        : draft-mattsson-cfrg-det-sigs-with-noise-04.txt
	Pages           : 16
	Date            : 2022-02-15

Abstract:
   Deterministic elliptic-curve signatures such as deterministic ECDSA
   and EdDSA have gained popularity over randomized ECDSA as their
   security do not depend on a source of high-quality randomness.
   Recent research has however found that implementations of these
   signature algorithms may be vulnerable to certain side-channel and
   fault injection attacks due to their determinism.  One countermeasure
   to such attacks is to re-add randomness to the otherwise
   deterministic calculation of the per-message secret number.  This
   document updates RFC 6979 and RFC 8032 to recommend constructions
   with additional randomness for deployments where side-channel attacks
   and fault injection attacks are a concern.  The updates are invisible
   to the validator of the signature and compatible with existing ECDSA
   and EdDSA validators.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-mattsson-cfrg-det-sigs-with-noise/

There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-mattsson-cfrg-det-sigs-with-noise-04.html

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-mattsson-cfrg-det-sigs-with-noise-04

Internet-Drafts are also available by rsync at rsync.ietf.org::internet-drafts

---

From: John Mattsson <[email-masked]>
Date: Tue, 15 Feb 2022 14:00:19 +0000

Hi,

We have updated based on the comments received during the adoption call as well as errata pointed out more recently on the list:

- Ilari Liusvaara and Ruggero Susella pointed out that the draft mixes up bits and bytes in some places. Carsten Bormann commented on bytes vs. octets. The -04 version used only "octets" to align with RFC 8032.

- Ilari pointed out that context might be bigger than 128 bytes. Changed to multiple of 128/136 octets.

- Jim Schaad expressed strong support for the use of KMAC together with SHAKE. Support also from Janos Follath. -04 added a new paragraph stating that HMAC MAY be used but KMAC is RECOMMENDED when SHAKE is used.

- Added a sententence that detminitic signatures are not secure in multi-sing setting with a reference to FROST.

- Based on a comment from Phillip Hallam-Baker more text on benefits with deterministic signatures was added "This makes verification of implementations easier."

- Based on a comment from Jim Schaad it was added clearly early in the document that the updates are "invisible to the validator of the signature.". Makes me sad that this was very likely the last time I added Jim's name to an Acknowledgments section....

Comments and issues that have not been addressed yet are summarized in Section 6 of the draft.

Cheers,
John

From: CFRG <[email-masked]> on behalf of [email-masked] <[email-masked]>
Date: Tuesday, 15 February 2022 at 14:54
To: [email-masked] <[email-masked]>
Cc: [email-masked] <[email-masked]>
Subject: [CFRG] I-D Action: draft-mattsson-cfrg-det-sigs-with-noise-04.txt

Abstract:

_______________________________________________
CFRG mailing list
[email-masked]
https://protect2.fireeye.com/v1/url?k=31323334-501d5122-313273af-454445555731-40f7d10cf9eb7c69&q=1&e=6e59d256-d95c-4d1c-8fc5-606ff8918ce3&u=https%3A%2F%2Fwww.irtf.org%2Fmailman%2Flistinfo%2Fcfrg

---

From: Carsten Bormann <[email-masked]>
Date: Tue, 15 Feb 2022 15:06:09 +0100

On 2022-02-15, at 15:00, John Mattsson <john.mattsson=[email-masked]> wrote:
> 
> The -04 version used only "octets" to align with RFC 8032.

Purely editorial comment: That is a regression.

Grüße, Carsten