6
$\begingroup$

In the IETF Draft Deterministic ECDSA and EdDSA Signatures with Additional Randomness, methods had been specified to seed RNG deterministically with external input, to securely obtain a nonce for use in signing formula. The external input is variable to mitigate certain side-channel that may occur with fully deterministic signing.

However, the draft seem to have expired, with several security-related issue outstanding. I'm interested in implementing the said draft, but before that, I need to be certain that what it specify is something stable.

So what's the current status of that draft? I tried to follow the link to mailing list, but to no avail.

Improve this question
$\endgroup$
6
  • $\begingroup$ The main obstacles seem to be about IPR according to the 2022-08-05 mail from Alexey Melnikov. $\endgroup$
    – DannyNiu
    May 17 at 1:26
  • $\begingroup$ I'd recommend doing it the Soatok way because then it's implementable with existing APIs. $\endgroup$
    – samuel-lucas6
    May 17 at 9:01
  • $\begingroup$ @samuel-lucas6 That sounds interesting. But I'm planning to take a different approach for my suite. Specifically, 2 variants - 1 take a seeded PRNG and a random bits generating function; 1 take a nonce string (and its length, since it's in C) - the latter seeds a random oracle which is passed as the PRNG instance to the former. $\endgroup$
    – DannyNiu
    May 17 at 11:17
  • $\begingroup$ That Draft RFC reads like a research paper to be honest. I'm not against such a scheme, but introduce it as a paper, not a standard. Standards should be for algorithms that have been researched and have seen some practical use. $\endgroup$
    – Maarten Bodewes ♦
    May 21 at 16:21
  • $\begingroup$ @MaartenBodewes I see some of us have some good opinion about the draft, so maybe bring the discussion to the CFRG list? $\endgroup$
    – DannyNiu
    May 22 at 11:30

1 Answer 1

Reset to default
1
$\begingroup$

This is an interim answer. The technical aspects are meant as outsider comment and may be reposted to the CFRG mailing list when I subscribe to it.

Bureaucracy Aspect

Although the draft is expired, the document is still in "Active RG Document" state. All? IETF drafts have maximum 6 months. Those merit further developent will see state change throughout its life.

The "Active RG Document" is defined as:

This document has been adopted by the RG and is being actively developed

Where RG stands for "research group". (CFRG being the one we're discussing here).

Technical Aspect

The updates the draft prescribed for EdDSA isn't intricate. From my experience implementing the draft, I find these issues for ECDSA.

Problem 1

The draft treats the HMAC calls as white box interaction across the boundary of HMAC-DRBG. The original intent of RFC6979 is to be able to reuse existing PRNG implementation un-modified, and the draft changed that.

Specifically, if the random nonce Z is variable length, then one of the following happens:

  • the implementation make hosted calls to allocate memory for the seed material.

  • the implementation penetrate the PRNG boundary and make individual calls to stream nonce and private key into the HMAC working context.

Those who has read NIST-SP-800-90Ar1 will know how serious NIST is about DRBG boundary.

Luckily for now, Z is specified to be fixed-length. And I've experimented with a 3rd approach,

  • hash Z and construct seed material buffer in a statically-sized stack buffer.

Problem 2

The draft recommends KMAC when ECDSA is instantiated with SHAKE. But with one important detail missing:

  • When generating output, do we use KMAC as a XOF, or fixed-length hash and call KMAC repeatedly?

And I ask this not to solicit answer, but to inspire to think, with Keccak, are we really satisfied with any of the NIST-SP-800-90Ar1 DRBGs? NIST had suggested the possibility of a permutation-based PRNG in the last few slides in one of their presentations, shoudn't we push harder and request for one be specified? possibly after another public contest?

Put up or shut up

For those interested in how the draft work in practice, I've implemented it in a branch of my spare-time project.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.