Is it possible to make RSA-PSS signing deterministic without loss of security?
Specifically, I would use Blake2b of the key and message to generate the salt.
Is it possible to make RSA-PSS signing deterministic without loss of security?
Specifically, I would use Blake2b of the key and message to generate the salt.
Any probabilistic signature scheme can be made deterministic without any loss of security. The generic transformation is as follows:
It is not difficult to prove that the scheme is secure, as long as the probabilistic scheme is secure and $F$ is a PRF. (The bounds of the probabilistic scheme stay the same as well; the only difference is that you add the probability of breaking the PRF, which is insignificant.) In practice, this can be very efficient, by using HMAC or CMAC and then stretching the output to the required length using the result as a key to AES-CTR, or using HKDF or something of the sort.
In fact, it is very unfortunate that this is not the standard way of deploying dSA and ECDSA, since that would resolve the major weakness which is that if the same randomness is used for different messages, then the secret key is revealed.