Subject: Re: [saag] Standard Crypto Algorithm Name (SCAN) for Deterministic Signatures (RFC 6979)

From: Simon Josefsson <[email-masked]>
Date: Fri, 06 May 2016 12:11:05 +0200

Jeffrey Walton <[email-masked]> writes:

> What are the standard algorithm names for deterministic signatures
> when applied to DSA and ECDSA?
>
> DSA, DSA/SHA-1 and friends are usually fine for most cases, but I'm
> working in an area that needs more precision so an object factory can
> serve up the correct type.

I am not aware of any well established names.

How about we introduce some?  The obvious suggestion would be:

DDSA: Deterministic Digital Signature Algorithm
DECDSA: Deterministic Elliptic Curve Digital Signature Algorithm

One could argue that the best solution is to change all implementations
of non-deterministic (EC)DSA to be deterministic.

Having non-determinism appears to serve no significant benefit and has
significant known concerns.  Is anyone aware of significant valid
technical reason for not using the deterministic variant of (EC)DSA
generally?  RFC 6979 mentions:

   Conversely, lack of randomization may have adverse effects in some
   advanced protocols, e.g., related to anonymity in some voting
   schemes.  As a rule of thumb, deterministic DSA or ECDSA can be used
   in lieu of the genuine DSA or ECDSA, with no additional security
   issues, if the overall protocol would tolerate another deterministic
   signature scheme, in particular RSA as specified in PKCS #1 [RFC3447]
   (with "type 1" padding, not PSS) or ISO 9796-2 [ISO-9796-2].  The
   list of protocols in which deterministic DSA or ECDSA is appropriate
   includes Transport Layer Security (TLS) [RFC5246], the Secure SHell
   (SSH) Protocol [RFC4251], Cryptographic Message Syntax (CMS)
   [RFC5652] and derivatives, X.509 public key infrastructures
   [RFC5280], and many others.

However I believe these more advanced protocols require more of the
signature system than what (EC)DSA were designed to offer, and that they
ought not to rely on (EC)DSA directly but a specialized variant of them.
Lack of references in the RFC to particular protocols makes my theory
hard to evaluate though.

/Simon