1
$\begingroup$

I'm exploring the security implications of utilizing a deterministic ECDSA signature as a cipher key for symmetric encryption and would appreciate insights from the community. Here's the setup I'm considering:

  1. Signature Generation: A deterministic ECDSA signature is generated using the secp256k1 curve. The private key and a public well-known message are combined to create this signature.

  2. Further Processing: The generated signature is then hashed using SHA-256 to break any potential non-uniform randomness in the signature?

  3. Application: The resulting hash is contemplated as a cipher key for symmetric encryption, specifically to encrypt wallet metadata.

Assumptions:

  • The ECDSA signature (and hash) remains confidential and is not disclosed.
  • The private key used for signing the message is unique to this operation and isn't reused for other signatures.
  • It uses a well-known signing software / device.

Questions for the Community:

  • Does this approach provide a cryptographically secure method for generating cipher keys for symmetric encryption?
  • Can the deterministic nature of the ECDSA signature, combined with the additional SHA-256 hashing, offer sufficient entropy and security for this purpose?
  • Are there any potential security risks or vulnerabilities associated with using a signature-based method for cipher key generation, especially considering the deterministic and public nature of the components involved?

I aim to ensure that the only additional piece of information users need to store besides their mnemonic is the public message used for signing, maintaining simplicity and security for hardware wallet (HWW) users.

Any insights, references, or considerations on this topic would be greatly appreciated.

$\endgroup$
2
  • 2
    $\begingroup$ I don't quite understand the setup.. Where does the signing key leave in this scenario? It has to be close to where signatures are generated. Wouldn't a key derivation function better serve your goal here? $\endgroup$ Feb 7 at 23:02
  • $\begingroup$ The choice between deriving a key and using a signature is influenced by our wallet's dual support for mnemonics and Hardware Wallets (HWW), where direct (private) key derivation isn't feasible due to their secure design. While we could use a derived publicKey for encryption from a deterministic non-standard path, a signature on a public message offers clearer user intent. This approach not only aligns with HWW constraints but also enhances user experience by making the encryption purpose explicit through the message. $\endgroup$
    – landabaso
    Feb 8 at 6:33

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.