# Elliptic curve signature scheme without a nonce

ECDSA and EdDSA both require the generation of a single-use value. Are there any elliptic curve signature schemes in existence which don't require nonce and maintain the usual security strength equal to that offered by the curve?

• Are you looking to get a deterministic signature? If so, see datatracker.ietf.org/doc/html/rfc6979 Commented Aug 11, 2023 at 3:02
• @knaccc No. RFC 6979 involves signature schemes which use nonces, even if it makes them deterministic. I am looking for a signature scheme that doesn't require an additional value like DSA and ECDSA do. Commented Aug 12, 2023 at 16:56
• As soon as the nonce is deterministic, it's no longer technically a nonce, since the value will be used more than once if the same message is signed in the future. It can just be thought of as part of the signature calculation. Can you explain your motivation to avoid a nonce? Commented Aug 12, 2023 at 19:26
• @knaccc An elliptic curve signature scheme that doesn't necessitate a non-reusable value which, if reused with a different combination of values, would break the scheme. RSA as a signature scheme is an example of what I mean. (Good grief.) Commented Aug 12, 2023 at 23:34
• There is a difference in nature between DSA or ECDSA on one hand, and EdDSA on the other hand. For the former kind we need a TNRG to generate a nonce. For the later we don't, and the closest thing to a nonce will be reused, and safely so, anytime it's twice computed the signature of the same message. Thus the risk of catastrophic private key leak by nonce reuse thru broken TRNG exists in the former kind, not the later. I get why due to this, we would not want DSA or ECDSA as standardized (with random nonce). It's less clear for EdDSA (or DSA/ECDSA modified to be deterministic). @Melab
– fgrieu
Commented Aug 13, 2023 at 16:39