0
$\begingroup$

I am newbie to cryptography and my college has given me this ECDSA. I know that you have to divide result of: h(m)+r.priv in order to generate signature. But is it possible to generate signature without Nonce or 'K' when I have private key(priv) and a selected r and an hash of message?

$\endgroup$
4
  • 2
    $\begingroup$ There is deterministic ECDSA rfc6979 other than this it is not safe. $\endgroup$
    – kelalaka
    Jan 23, 2022 at 10:17
  • $\begingroup$ r and H(m) are both public knowledge, so based on your understanding, would this be secure? $\endgroup$ Jan 23, 2022 at 10:18
  • $\begingroup$ @meshcollider no, but I am just askin' if it is possible? $\endgroup$
    – guest
    Jan 23, 2022 at 10:25
  • $\begingroup$ What is the origin of this question? $\endgroup$
    – kelalaka
    Jan 23, 2022 at 10:39

1 Answer 1

2
$\begingroup$

Yes, it's normal practice to generate an ECDSA signature from message $M$ (or it's hash $H(M)$ ), private key $d_U$ and curve parameters, without being given a nonce as input. The nonce $k$ is built as part of the signing process, in one of two ways:

  1. It's generated a secret integer $k$ uniformly in $[1,n)$ using a true random number generator with secret output. That's the standard definition of ECDSA.
  2. It's generated a secret integer $k$ in $[1,n)$ using a Pseudo Random Function with key $d_U$, applied to $H(M)$ and optionally other data that needs not be secret (such as a timestamp, or/and a random number). That's what RFC6979 does, prescribing a PRF based on HMAC.

Both methods are as secure: in essence, $k$ is a secret in $[1,n)$ that, to attackers who do not know the private key $d_U$, is unknown and, if it was known, would appear to be random (except for the second option if the same $M$ is re-signed and the optional other data repeats or is absent).

The second method has the advantage of not requiring a true random number generator of cryptographic quality. However it uses private key $d_U$ (and worse mixes it with variable data potentially known to the adversary), therefore the PRF must be protected against side-channel attacks.

Only the second method can insure that signing the same message twice with the same private key generates the same signature, which depending on circumstances is desirable, or not.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.