1
$\begingroup$

I'm learning DSA and I'm wondering if $k$ can be 1. I know that k has to be from $\mathbb{Z}_{q-1}$ but I don't know whether 1 is allowed (not talking about security concerns, purely educational). I know that h can't be 1, because $h^{(p-1)/q}>1$ but I don't know about $k$.

$\endgroup$
  • $\begingroup$ @kelalaka I tried it and R was the same as S. However, I was still able to sign the message and verify the signature. Is that a problem? $\endgroup$ – Mallard Nov 27 '19 at 19:34
  • $\begingroup$ @kelalaka no, would that open some attack vectors? $\endgroup$ – Mallard Nov 27 '19 at 19:45
  • $\begingroup$ Though in theory I think $k=1$ is allowed though it actually occuring has a really small probability of roughly $1/q$ (as has any other fixed value knowing which immediately breaks DSA fully). $\endgroup$ – SEJPM Nov 27 '19 at 22:00
2
$\begingroup$

The $k$ is randomly chosen as nonce (number used once) from the range $[1,q\hbox{ - }1]$ according to NIST FIPS 186-4. As far as I've searched there is no reason not to use $k=1$. The probability of selection $k=1$ is $1/q$ and that is actually is very small.

You should not re-use any $k$. That simply breaks it. A linearly increased $k$ is also insecure. More than those any small bias while selection the $k$ can be catastrophic. See;

Also, one should not reveal any $k$ used for a signature made public. That compromises the private key, just as re-using any $k$ for two signatures made public. As a consequence, one should not purposely use $k=1$, nor any other particular public value ( thanks to fgrieu).

One can also use a deterministic process to generate the $k$:

  • RFC-6979 Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA) : talks about

    It is possible to turn DSA and ECDSA into deterministic schemes by using a deterministic process for generating the "random" value k. That process must fulfill some cryptographic characteristics in order to maintain the properties of verifiability and unforgeability expected from signature schemes; namely, for whoever does not know the signature private key, the mapping from input messages to the corresponding k values must be computationally indistinguishable from what a randomly and uniformly chosen function (from the set of messages to the set of possible k values) would return.

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.