DSA - can $k$ be 1?

I'm learning DSA and I'm wondering if $$k$$ can be 1. I know that k has to be from $$\mathbb{Z}_{q-1}$$ but I don't know whether 1 is allowed (not talking about security concerns, purely educational). I know that h can't be 1, because $$h^{(p-1)/q}>1$$ but I don't know about $$k$$.

• @kelalaka I tried it and R was the same as S. However, I was still able to sign the message and verify the signature. Is that a problem? Nov 27, 2019 at 19:34
• @kelalaka no, would that open some attack vectors? Nov 27, 2019 at 19:45
• Though in theory I think $k=1$ is allowed though it actually occuring has a really small probability of roughly $1/q$ (as has any other fixed value knowing which immediately breaks DSA fully). Nov 27, 2019 at 22:00

The $$k$$ is randomly chosen as nonce (number used once) from the range $$[1,q\hbox{ - }1]$$ according to NIST FIPS 186-4. As far as I've searched there is no reason not to use $$k=1$$. The probability of selection $$k=1$$ is $$1/q$$ and that is actually is very small.

You should not re-use any $$k$$. That simply breaks it. A linearly increased $$k$$ is also insecure. More than those any small bias while selection the $$k$$ can be catastrophic. See;

Also, one should not reveal any $$k$$ used for a signature made public. That compromises the private key, just as re-using any $$k$$ for two signatures made public. As a consequence, one should not purposely use $$k=1$$, nor any other particular public value ( thanks to fgrieu).

One can also use a deterministic process to generate the $$k$$:

• RFC-6979 Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA) : talks about

It is possible to turn DSA and ECDSA into deterministic schemes by using a deterministic process for generating the "random" value k. That process must fulfill some cryptographic characteristics in order to maintain the properties of verifiability and unforgeability expected from signature schemes; namely, for whoever does not know the signature private key, the mapping from input messages to the corresponding k values must be computationally indistinguishable from what a randomly and uniformly chosen function (from the set of messages to the set of possible k values) would return.