Deterministic ECDSA and EdDSA Signatures with Additional Randomness
draft-mattsson-cfrg-det-sigs-with-noise-02

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 00
• 01
• 02

Network Working Group                                 J. Preuss Mattsson
Internet-Draft                                             E. Thormarker
Updates: 6979, 8032 (if approved)                            S. Ruohomaa
Intended status: Informational                                  Ericsson
Expires: September 12, 2020                               March 11, 2020

  Deterministic ECDSA and EdDSA Signatures with Additional Randomness
               draft-mattsson-cfrg-det-sigs-with-noise-02

Abstract

   Deterministic elliptic-curve signatures such as deterministic ECDSA
   and EdDSA have gained popularity over randomized ECDSA as their
   security do not depend on a source of high-quality randomness.
   Recent research has however found that implementations of these
   signature algorithms may be vulnerable to certain side-channel and
   fault injection attacks due to their determinism.  One countermeasure
   to such attacks is to re-add randomness to the otherwise
   deterministic calculation of the per-message secret number.  This
   document updates RFC 6979 and RFC 8032 to recommend constructions
   with additional randomness for deployments where side-channel attacks
   and fault injection attacks are a concern.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on September 12, 2020.

Copyright Notice

   Copyright (c) 2020 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents

Preuss Mattsson, et al.Expires September 12, 2020               [Page 1]
Internet-Draft            Hedged ECC Signatures               March 2020

   (https://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Updates to RFC 8032 (EdDSA) . . . . . . . . . . . . . . . . .   4
   3.  Updates to RFC 6979 (Deterministic ECDSA) . . . . . . . . . .   5
   4.  Security Considerations . . . . . . . . . . . . . . . . . . .   5
   5.  For discussion (to be removed in the future)  . . . . . . . .   7
   6.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   7
     6.1.  Normative References  . . . . . . . . . . . . . . . . . .   7
     6.2.  Informative References  . . . . . . . . . . . . . . . . .   8
   Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . .  12
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  12

1.  Introduction

   In Elliptic-Curve Cryptography (ECC) signature algorithms, the per-
   message secret number has traditionally been generated from a random
   number generator (RNG).  The security of such algorithms depends on
   the cryptographic quality of the random number generation and biases
   in the randomness may have catastrophic effects such as compromising
   private keys.  Repeated per-message secret numbers have caused
   several severe security accidents in practice.  As stated in
   [RFC6979], the need for a cryptographically secure source of
   randomness is also a hindrance to deployment of randomized ECDSA
   [FIPS-186-4] in architectures where secure random number generation
   is challenging, in particular, embedded IoT systems and smartcards.
   [ABFJLM17] does however state that smartcards typically has a high-
   quality RNG on board, which makes it significantly easier and faster
   to use the RNG instead of doing a hash computation.

   In deterministic ECC signatures schemes such as Deterministic
   Elliptic Curve Digital Signature Algorithm (ECDSA) [RFC6979] and
   Edwards-curve Digital Signature Algorithm (EdDSA) [RFC8032], the per-
   message secret number is instead generated in a fully-deterministic
   way as a function of the message and the private key.  Except for key
   generation, the security of such deterministic signatures does not
   depend on a source of high-quality randomness.  As they are presumed