Skip to main content
replaced https://tools.ietf.org/html/rfc with https://www.rfc-editor.org/rfc/rfc
Source Link

With DSA / ECDSA using a fixed $k$ means the private key can be trivially easily calculated from two different signatures. To remedy this RFC6979 Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA)RFC6979 Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA) was developed.

OAEP / PSS, as described in PKCS#1 v2.0+, used randomized values as well.

For PSS I guess it isn't a huge problem since the only randomized element is the salt and the salt has a variable length with 0 being a valid length.

For OAEP my assumption is that the only issue with a fixed seed is that if the same message were encrypted twice you'd be see the same ciphertext each time. Or is there another more severe issue that the randomized seed protects against?

I note that the original encryption described in PKCS1 employees randomized padding as well.

With DSA / ECDSA using a fixed $k$ means the private key can be trivially easily calculated from two different signatures. To remedy this RFC6979 Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA) was developed.

OAEP / PSS, as described in PKCS#1 v2.0+, used randomized values as well.

For PSS I guess it isn't a huge problem since the only randomized element is the salt and the salt has a variable length with 0 being a valid length.

For OAEP my assumption is that the only issue with a fixed seed is that if the same message were encrypted twice you'd be see the same ciphertext each time. Or is there another more severe issue that the randomized seed protects against?

I note that the original encryption described in PKCS1 employees randomized padding as well.

With DSA / ECDSA using a fixed $k$ means the private key can be trivially easily calculated from two different signatures. To remedy this RFC6979 Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA) was developed.

OAEP / PSS, as described in PKCS#1 v2.0+, used randomized values as well.

For PSS I guess it isn't a huge problem since the only randomized element is the salt and the salt has a variable length with 0 being a valid length.

For OAEP my assumption is that the only issue with a fixed seed is that if the same message were encrypted twice you'd be see the same ciphertext each time. Or is there another more severe issue that the randomized seed protects against?

I note that the original encryption described in PKCS1 employees randomized padding as well.

Source Link
neubert
  • 3k
  • 1
  • 29
  • 56

consequences of using fixed values with OAEP

With DSA / ECDSA using a fixed $k$ means the private key can be trivially easily calculated from two different signatures. To remedy this RFC6979 Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA) was developed.

OAEP / PSS, as described in PKCS#1 v2.0+, used randomized values as well.

For PSS I guess it isn't a huge problem since the only randomized element is the salt and the salt has a variable length with 0 being a valid length.

For OAEP my assumption is that the only issue with a fixed seed is that if the same message were encrypted twice you'd be see the same ciphertext each time. Or is there another more severe issue that the randomized seed protects against?

I note that the original encryption described in PKCS1 employees randomized padding as well.