3 ms·

Time to switch to EdDSA?

• nullc 12y ago
  The paper has basically three parts. (1) Shows attacks on ECDSA where there is a one bit of bias on the nonce. These should work equally well on Schnorr signatures of their various forms, including EdDSA (though EdDSA proscribes a particular nonce generation scheme which should hopefully not result in observable biases, other standards proscribe similar schemes for ECDSA users, e.g. RFC6967). If it turns out that the hash functions used for deterministic dsa in these systems are biased, this attack crops back up. (It's not news that biased RNGs can result in these attacks; the interesting part is that they were able to actually perform an attack on a non-toy curve, with only a one bit bias. Past attacks were mostly theory, and also needed more bias.) (2) Some unusual curves can have an optimization which common implementations might take which results in biased nonces. These curves are not widely used on the Internet. I'm doubtful you've ever heard of them (except Bitcoin's curve, which is a GLV curve, but I'm relatively confident _no one_ is using the endomorphism in signing). They also give advice on avoiding that weakness. (3) One way of avoiding the weakness while still using the optimization is to decompose a uniform number instead of using two random numbers, they show an argument for a power attack against a candidate constant time decomposition algorithm. Again, moot if you're not using the optimization.