Questions tagged [rfc6979]

RFC6979 "Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA)"

Filter by
Sorted by
Tagged with
0 votes
0 answers
96 views

Apple secure enclave with RFC6979

Does Apple secure enclave support rfc6979 with P256 curve? This RFC defines a deterministic ecdsa with a deterministic k value. THATS LINK OF THE RFC https://www.rfc-editor.org/rfc/rfc6979 I looked ...
mathcrypto's user avatar
2 votes
1 answer
186 views

What degree of k bias is acceptable in ECDSA?

So there’s LadderLeak. RFC6979 produces uniformly random nonce $k$. There are other techniques, such as hash-to-curve standard (draft-irtf-cfrg-hash-to-curve-16 section 5), which allows to produce ...
Paul Miller's user avatar
0 votes
1 answer
44 views

Is it possible to define a new custom signed attribute for CAdES?

Is it possible to introduce a new signed attribute in the CMS Advanced Signature format (RFC 5126) for a custom data type? I want to include location data from GPS or Galileo and extend CAdES for my ...
zima blue's user avatar
1 vote
1 answer
375 views

Reusing additional data k' nonce from RFC6979 ECDSA

It is known that you must not reuse k in ECDSA; doing so will leak your private key. That's one of the reasons RFC6979 deterministic signatures were invented. Now, ...
Paul Miller's user avatar
1 vote
0 answers
147 views

Security proof about RFC 6979

In the paper: "The Random Oracle Model: a Twenty-Year Retrospective", section 7.3 by Koblitz & Menezes,the authors tried to prove the security of ECDSA+. But after looking at the entire ...
Steven Wu's user avatar
0 votes
1 answer
134 views

Why does RFC 6979 need so many loops?

I recently started reading RFC 6979. I'm curious why it needs so many loops. This post asks a similar question: "RFC 6979 - Why not simply hash the message & the private key for deterministic ...
Steven Wu's user avatar
1 vote
1 answer
414 views

Why does deterministic ECDSA (per RFC 6979) include the private key in the generation of k?

It's clear that using the private ECDSA key $x$ as an additional input into the hash algorithm, as specified in RFC 6979, doesn't harm security (assuming HMAC_DRBG is a PRF). But is it necessary? ...
lxgr's user avatar
  • 1,798
2 votes
1 answer
128 views

Question about IETF RFC6979 determinisitc (EC)DSA document section 3.6 additional data k'

In RFC6979, on page 14, Section 3.6 "Variants": o. Additional data may be added to the input of HMAC, concatenated after bits2octets(H(m)): ...
anmin's user avatar
  • 41
8 votes
1 answer
910 views

RFC6979: error in reference implementation?

If I correctly understand RFC 6979, there is an error in the ref implementation section 3.2. In the step H2, RFC specification says ...
cslashm's user avatar
  • 413