BIP 340 improvements #893

 171 | +* Let ''sig = bytes(R) || bytes((k + ed) mod n)''.
 172 | +* If ''Verify(bytes(P), m, sig)'' (see below) returns failure, abort<ref>Verifying the signature before leaving the signer prevents random or attacker provoked computation errors. This prevents publishing invalid signatures which may leak information about the secret key. It is recommended, but can be omitted if the computation cost is prohibitive.</ref>.
 173 | +* Return the signature ''sig''.
 174 |  
 175 | -When an RNG is available at signing time, up to 32 bytes of its output should be included in ''a''. The result is then called a ''synthetic nonce''. Doing so may improve protection against [https://moderncrypto.org/mail-archive/curves/2017/000925.html fault injection attacks and side-channel attacks]. Therefore, '''synthetic nonces are recommended in settings where these attacks are a concern''' - in particular on offline signing devices. Adding more than 32 bytes serves no security purpose. Note that while this means the resulting nonce is not deterministic, its normal security properties do not depend on the quality of the RNG, and in fact using a completely broken RNG is still secure.
 176 | +The auxiliary random data should be set to fresh randomness generated at signing time, resulting in what is called a ''synthetic nonce''. If no randomness is available, a simple counter can be used as well, or even nothing at all. Using any non-repeating value increases protection against [https://moderncrypto.org/mail-archive/curves/2017/000925.html fault injection attacks]. Using unpredictable randomness additionally increases protection against other side-channel attacks, and is '''recommended whenever available'''. Note that while this means the resulting nonce is not deterministic, the randomness is only supplemental to security. The normal security properties (excluding side-channel attacks) do not depend on the quality of the signing-time RNG.

jonasnick commented at 11:07 AM on February 24, 2020:

Perhaps s/should be set to fresh randomness/should be set to 32 bytes of fresh randomness/ to provide a clear recommendation.

jonasnick commented at 2:18 PM on March 7, 2020:

this is resolved

 151 |  Input:
 152 |  * The secret key ''sk'': a 32-byte array
 153 |  * The message ''m'': a 32-byte array
 154 | +* Auxiliary random data ''a'': a byte array of length 0 to 32 (inclusive)
 155 |  
 156 |  The algorithm ''Sign(sk, m)'' is defined as:

LLFourn commented at 3:33 AM on February 26, 2020:

missing a as an argument.

 149 |  ==== Default Signing ====
 150 |  
 151 |  Input:
 152 |  * The secret key ''sk'': a 32-byte array
 153 |  * The message ''m'': a 32-byte array
 154 | +* Auxiliary random data ''a'': a byte array of length 0 to 32 (inclusive)

jonasnick commented at 1:44 PM on February 28, 2020:

How about we fix a to be 32 bytes (or alternatively 0 or 32 bytes). This would make the test vectors much simpler because otherwise we will want to have a test vector with an a that is in between. Making the libsecp compatible with variable len a is unnecessarily complicated as the caller would need to provide a byte array for a that also encodes the length. So either we make a (0 or 32 bytes) or we need to design the test vectors such that only one of them has an in-between a and skip that one it in libsecp.

jonasnick commented at 2:18 PM on March 7, 2020:

this is resolved