[openpgp] Re: I-D Action: draft-ietf-openpgp-pqc-14.txt

> Falko Strenzke:
> nevertheless it would be possible to deliberately violate the standard by using
> repeated salt values and the deterministic variant of ML-DSA and 
> thus obtain deterministic signatures

> Aron Wussler:
> OpenPGP v6 signatures include a prepended random salt on the protocol level,
> deterministic signatures are therefore unattainable.

I didn’t notice that change in v6; thanks.

Although that could improve security for many use cases, it’s less attractive
for code signing purposes. Code signing is often done in an HSM, which might
be less susceptible to side channel attacks than the main CPU.

It's a lot simpler to just compare two binaries than try to divide them into
reproducible + non-reproducible parts, and be sure the non-reproducible parts
are limited to just the signature fields.

Software offering a mechanism to inject poor salt values increases risk in
accidentally allowing them when not wanted, so it'd be good to avoid.

Could a special Signature Type be defined to convey that intention?

0x00  Binary Signature  (as is)

0xNEW Reproducible Binary Signature
    specifies using no salt value (regardless of the hash choice) and using
    a deterministic signing algorithm (e.g., EdDSA, deterministic ECDSA per
    FIPS 186-5, deterministic ML-DSA, deterministic SLH-DSA, or a composite
    using all deterministic algorithms)

A verifier in a non-code signing use case in which the salt is important
could reject that new Signature Type. Code signing verifiers could
accept both.

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]