Subject: Re: [MLS] On the Insider Security of MLS

From: Paul Rösler <[email-masked]>
Date: Fri, 23 Oct 2020 12:36:43 +0200

Hi Joël,

this sounds indeed promising and interesting! One point on the security
of EdDSA:

On 23.10.20 12:00, Joel Alwen <[email-masked]> wrote:
>  2) ECDSA vs. EdDSA : We found that we could have proven stronger security if
> only EdDSA were used vs. if ECDSA is permitted. ECDSA sigs produced with a bad
> PRNG (i.e. not enough entropy) can result in sigs that reveal the signing keys.
> EdDSA signatures are deterministic and so aren't susceptible to this. ECDSA can
> also be de-randomized (RFC 6979) to avoid the problem.

While EdDSA (and deterministic ECDSA) is not vulnerable to weak
randomness, it can be attacked equally devastatingly via fault attacks
(e.g., bit flips), which we demonstrate in [2]. Since attacks against
randomness and bit flips during signing can both be practical, a
compromise between the benefits of both signing variants, like XEdDSA,
could probably fit better.

Cheers,
Paul

[2] Attacking Deterministic Signature Schemes using Fault Attacks.
Poddebniak, Somorovsky, Schinzel, Lochter, Rösler.
https://eprint.iacr.org/2017/1014.pdf

---

From: Joel Alwen <[email-masked]>
Date: Mon, 26 Oct 2020 13:57:41 +0100

Yeah, EdDSA, and especially (randomized) ECDSA, really aren't ideal choices from
a security perspective. But I think their main advantage over other schemes
(like XEdDSA) is that they are widely implemented (at production quality) and
even part of various standards (e.g. FIPS) which people have to adhere to. For
MLS that's available implementations are a must. (Thats why MLS doesn't use UPKE
like in rTreeKEM though the security benefits are clear.)

Do you happen to know if there are any alternative schemes with better
properties (like XEdDSA) that have at least some amount of production quality
implementations?

- Joël

---

From: Natanael <[email-masked]>
Date: Thu, 29 Oct 2020 19:21:59 +0100

Randomness Improvements for Security Protocols - randomness wrapper, for
use with deterministic signatures

https://tools.ietf.org/html/rfc8937

Does this have the properties you need?

Den mån 26 okt. 2020 13:57Joel Alwen <[email-masked]> skrev:

> _______________________________________________
> MLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mls
>