Deterministic ECDSA and EdDSA Signatures with Noise
draft-mattsson-cfrg-det-sigs-with-noise-00

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 00

Network Working Group                                 J. Preuss Mattsson
Internet-Draft                                             E. Thormarker
Updates: 6979, 8032 (if approved)                            S. Ruohomaa
Intended status: Informational                                  Ericsson
Expires: June 19, 2020                                 December 17, 2019

          Deterministic ECDSA and EdDSA Signatures with Noise
               draft-mattsson-cfrg-det-sigs-with-noise-00

Abstract

   Deterministic elliptic-curve signatures such as deterministic ECDSA
   and EdDSA have gained popularity over randomized ECDSA as their
   security do not depend on a source of high-quality randomness.
   Recent research has however found that implementations of these
   signature algorithms may be vulnerable to certain side-channel and
   fault injection attacks due to their determinism.  One countermeasure
   to such attacks is to add noise to the otherwise deterministic
   calculation of the per-message secret number.  This document updates
   RFC 6979 and RFC 8032 to recommend constructions with noise for
   deployments where side-channel attacks and fault injection attacks
   are a concern.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on June 19, 2020.

Copyright Notice

   Copyright (c) 2019 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents

Preuss Mattsson, et al.   Expires June 19, 2020                 [Page 1]
Internet-Draft   Deterministic ECC Signatures with Noise   December 2019

   (https://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Updates to RFC 8032 (EdDSA) . . . . . . . . . . . . . . . . .   4
   3.  Updates to RFC 6979 (Deterministic ECDSA) . . . . . . . . . .   5
   4.  Security Considerations . . . . . . . . . . . . . . . . . . .   5
   5.  TODOs and Other Considerations  . . . . . . . . . . . . . . .   7
   6.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   8
     6.1.  Normative References  . . . . . . . . . . . . . . . . . .   8
     6.2.  Informative References  . . . . . . . . . . . . . . . . .   9
   Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . .  13
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  13

1.  Introduction

   In Elliptic-Curve Cryptography (ECC) signature algorithms, the per-
   message secret number has traditionally been generated from a random
   number generator (RNG).  The security of such algorithms depends on
   the cryptographic quality of the random number generation and biases
   in the randomness may have catastrophic effects such as compromising
   private keys.  Repeated per-message secret numbers have caused
   several severe security accidents in practice.  As stated in
   [RFC6979], the need for a cryptographically secure source of
   randomness is also a hindrance to deployment of randomized ECDSA
   [FIPS-186-4] in architectures where secure random number generation
   is challenging, in particular, embedded IoT systems and smartcards.
   [ABFJLM17] does however state that smartcards typically has a high-
   quality RNG on board, which makes it significantly easier and faster
   to use the RNG instead of doing a hash computation.

   In deterministic ECC signatures schemes such as Deterministic
   Elliptic Curve Digital Signature Algorithm (ECDSA) [RFC6979] and
   Edwards-curve Digital Signature Algorithm (EdDSA) [RFC8032], the per-
   message secret number is instead generated in a fully-deterministic
   way as a function of the message and the private key.  Except for key
   generation, the security of such deterministic signatures does not
   depend on a source of high-quality randomness.  As they are presumed
   to be safer, deterministic signatures have gained popularity and are