I'm learning DSA and I'm wondering if $k$ can be 1. I know that k has to be from $\mathbb{Z}_{q-1}$ but I don't know whether 1 is allowed (not talking about security concerns, purely educational). I know that h can't be 1, because $h^{(p-1)/q}>1$ but I don't know about $k$.
$\begingroup$
$\endgroup$
-
$\begingroup$ @kelalaka I tried it and R was the same as S. However, I was still able to sign the message and verify the signature. Is that a problem? $\endgroup$ – Mallard Nov 27 '19 at 19:34
-
$\begingroup$ @kelalaka no, would that open some attack vectors? $\endgroup$ – Mallard Nov 27 '19 at 19:45
-
$\begingroup$ Though in theory I think $k=1$ is allowed though it actually occuring has a really small probability of roughly $1/q$ (as has any other fixed value knowing which immediately breaks DSA fully). $\endgroup$ – SEJPM♦ Nov 27 '19 at 22:00
$\begingroup$
$\endgroup$
The $k$ is randomly chosen as nonce (number used once) from the range $[1,q\hbox{ - }1]$ according to NIST FIPS 186-4. As far as I've searched there is no reason not to use $k=1$. The probability of selection $k=1$ is $1/q$ and that is actually is very small.
You should not re-use any $k$. That simply breaks it. A linearly increased $k$ is also insecure. More than those any small bias while selection the $k$ can be catastrophic. See;
- How does the “biased-k attack” on (EC)DSA work?
- What is TPMFail attack and what are the countermeasures?
Also, one should not reveal any $k$ used for a signature made public. That compromises the private key, just as re-using any $k$ for two signatures made public. As a consequence, one should not purposely use $k=1$, nor any other particular public value ( thanks to fgrieu).
One can also use a deterministic process to generate the $k$:
RFC-6979 Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA) : talks about
It is possible to turn DSA and ECDSA into deterministic schemes by using a deterministic process for generating the "random" value k. That process must fulfill some cryptographic characteristics in order to maintain the properties of verifiability and unforgeability expected from signature schemes; namely, for whoever does not know the signature private key, the mapping from input messages to the corresponding k values must be computationally indistinguishable from what a randomly and uniformly chosen function (from the set of messages to the set of possible k values) would return.
