The elliptic JavaScript library implements a .sign function which seems to give the same result when signing the same message. That means the k param is constant. Doesn't that mean signing different messages exposes the private key? If that is the case, how can I correctly sign several messages with the same private key?
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
3
Elliptic says:
ECDSA is using deterministic k value generation as per RFC6979.
This means that every time you sign the same message you'll get the same random value used. That explains why you see the same $k$ param both times.
However, the $k$ value generation process takes the message (or the message hash) as an input. More specifically, $k$ is generated by hashing the message (hash) along with the private key. So every different message will produce a different $k$ value (apart from the negligible probability of hash collisions), and the same message will produce the same $k$ value every time it's signed.
Using the same random value with the same message is not a security risk (obviously, you just get the same signature). If you use the same random value with different messages you immediately reveal the private key, so as you note this should not be done. However, the RFC 6979 approach "ensures" that with extremely high probability different messages will use different ks.
-
$\begingroup$ Note that in this question I'm asking how to use Elliptic to sign different messages with the same private key, so your answer, while good, is still incomplete. Edit: oh, wait - do you mean that the implementation already does the hashing necessary so I don't need to worry at all? I thought you meant I had to previously do something with my message before calling
.sign. $\endgroup$ Commented Dec 23, 2016 at 16:15 -
$\begingroup$ Sorry, I'll edit my answer. If you like the edited answer can you delete your comment and I'll delete this one? $\endgroup$ Commented Dec 23, 2016 at 16:19
-
$\begingroup$ I get it now, sorry for the misunderstanding. $\endgroup$ Commented Dec 23, 2016 at 17:08