Score:0

What non-trivial benefit does including a "context"/"signer info" provide in SM2-DSS and EdDSA?

vu flag

While implementing SM2 DSS and reading RFC-8032 for EdDSA, I noticed that, both families of schemes provide provisions for including a "context" (in EdDSA) or "signer info" (in SM2 digital signature) in the signature.

Q1: What non-trivial benefit does it provide? Does it help prevent duplicate key attack?

Q2: Are there existing protocol or application that expect this feature from digital signature schemes?

Score:1
ng flag

In signature, a context or signer info allows the use of the same public/private key for multiple usages, without worrying that a signature for one usage could be passed by an attacker as a signature for another usage. Instead of having to establish a convention in message formatting allowing to recognize messages intended for each usage, it's used a unique constant as context for each usage.

Example: the key pair is used both in an authentication protocol where the signer signs a nonce sent by the other party, and to sign documents. If that was done without context, the authentication protocol could be abused to make the private key holder sign any document the size of a nonce.

There's something similar, called label, in RSAES-OAEP encryption. However there's no equivalent for signature in PKCS#1, and I have never actually seen use of context in a system using signature (e.g. use of Ed25519ctx of RFC 8032). Instead, practice is to have some convention on message. I've seen the first byte(s) of the message used for that purpose, but that's no longer easy with the trend of encoding messages per XML or JSON, or/and Base64†;


Don't start me on the various conventions about if the signature is on the encoded Base64 or on what it encodes, on if it's on the fields or the XML/JSON, on how the signature is often encoded as a field of the XML/JSON that it signs, on the canonicalization, what does it, and how.

Myria avatar
in flag
In an implementation of PKCS#1 signature format at my employer, we prepended a "label" / "context" to the data that got hashed; depending on what the purpose is, it can be as simple as that to avoid cross-usage attacks.
DannyNiu avatar
vu flag
@Myria Interesting. Do you have public specs for what you do? Do you do that with PKCS#1 v1.5 signature or RSASSA-PSS?
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.