3 ms·

Oh if only there were a elliptic curve digital signature algorithm that was side-channel resistant and well studied by cryptography experts. https://en.wikiped

Oh if only there were a elliptic curve digital signature algorithm that was side-channel resistant and well studied by cryptography experts. https://en.wikipedia.org/wiki/EdDSA https://en.wikipedia.org/wiki/EdDSA (Fortunately, we should see its adoption when TLS 1.3 is standardized.)

nullc 11y ago
EdDSA is not fundamentally more sidechannel resistant; sidechannel resistance is a function of the implementation. EdDSA's authors make a reasonable argument that it takes less work with their parameters to make a timing sidechannel free implementation which is also fast (at least for secret key operations); but "less work" isn't really the problem when comparing to a grotesquely vulnerable implementation, especially where it would be perfectly acceptable to take a slowdown implied by an especially simple way of making the operation constant time. It would be more accurate to say that so far EdDSA has had a more conscientious implementation culture around it. But I think that won't last if too many people misunderstand sidechannel resistance as automatic there (even now one can go to lists of ed25519 implementations and get linked, without warning, to implementations which are not sidechannel resistant at all).
- CiPHPerCoder 11y ago
  > EdDSA is not fundamentally more sidechannel resistant; sidechannel resistance is a function of the implementation. > ... > It would be more accurate to say that so far EdDSA has had a more conscientious implementation culture around it. Your assessment is correct. EdDSA is deterministic which eliminates the nonce-reuse concerns, but deterministic EdDSA/ECDSA requires side-channel resistance. I erred in my previous comment.
  - nullc 11y ago
    Right. One can easily implement EdDSA without deterministic nonce generation or with insecure nonce generation (it would be an error to call it EdDSA: but no verifier could tell; and if the signature is accepted that is EdDSA-enough for people to call it that in practice); likewise one could implement ECDSA with deterministic nonce generation (e.g. as specified in RFC6979). It's not hard to find examples of both.

nullc 11y ago

EdDSA is not fundamentally more sidechannel resistant; sidechannel resistance is a function of the implementation. EdDSA's authors make a reasonable argument that it takes less work with their parameters to make a timing sidechannel free implementation which is also fast (at least for secret key operations); but "less work" isn't really the problem when comparing to a grotesquely vulnerable implementation, especially where it would be perfectly acceptable to take a slowdown implied by an especially simple way of making the operation constant time. It would be more accurate to say that so far EdDSA has had a more conscientious implementation culture around it. But I think that won't last if too many people misunderstand sidechannel resistance as automatic there (even now one can go to lists of ed25519 implementations and get linked, without warning, to implementations which are not sidechannel resistant at all).

CiPHPerCoder 11y ago
> EdDSA is not fundamentally more sidechannel resistant; sidechannel resistance is a function of the implementation. > ... > It would be more accurate to say that so far EdDSA has had a more conscientious implementation culture around it. Your assessment is correct. EdDSA is deterministic which eliminates the nonce-reuse concerns, but deterministic EdDSA/ECDSA requires side-channel resistance. I erred in my previous comment.
- nullc 11y ago
  Right. One can easily implement EdDSA without deterministic nonce generation or with insecure nonce generation (it would be an error to call it EdDSA: but no verifier could tell; and if the signature is accepted that is EdDSA-enough for people to call it that in practice); likewise one could implement ECDSA with deterministic nonce generation (e.g. as specified in RFC6979). It's not hard to find examples of both.