Does RFC 6979 unconditionally prevent nonce-reuse attacks?

Melab

8/19/24, 8:34 PM

Is RFC 6979 guaranteed to prevent the reuse of nonces for different signed hashes?

241

1 + 0

nonce

Score:4

Crypto

poncho

8/19/24, 8:46 PM

No, it does not. No stateless procedure that can sign arbitrary messages can do that (that is, a procedure that doesn't record which nonces it has already generated and which does not limit the messages space it can sign to a small number, that is, no larger than the nonce space)

On the other hand, assuming reasonable assumptions on the hash functions it uses, it is no more likely to repeat a nonce than a uniformly distributed random number would.

+ 9

Melab

8/19/24, 9:36 PM

What if a block cipher with a width equal to the output size of the hash function was used to encrypt the to-be-sighed hash?

poncho

8/19/24, 9:42 PM

@Melab: the hash function would have collisions, hence two different messages (which hash to the same value) would have the same nonce

Melab

8/19/24, 9:43 PM

And that value was used as the nonce?

Melab

8/19/24, 9:54 PM

How would that impact the nonce-reuse scenario which enables the calculation of the private key? Only one to-be-signed hash $h$, when encrypted with a fixed key, can produce the same value, no?

Melab

8/19/24, 9:55 PM

It's not about collisions in the hash of the message.

poncho

8/20/24, 9:43 PM

@Melab: that is a good point - using the same nonce on two different messages is not an issue if those two messages hash to the same value (and so, as far as the core ECDSA signing is concerned, they are the same message). It occurs to me that you have to be careful about the encryption mode used; it feels like it would be an exploitable weakness if the attacker could have two different hashes that generate related ciphertexts. Your suggestion of a 'wide block cipher' is good; a FPE mode set to the hash output size (or larger) would be work as well...

Melab

8/21/24, 4:59 AM

The nonce is secret. The attacker wouldn't have access to it. If they did, then the private signing key can be recalculated.

Melab

8/22/24, 12:26 AM

Why FPE instead of a wide block cipher (which I didn't suggest in so many words)?

poncho

8/22/24, 1:04 AM

@Melab: well, there are some ciphers with 256 bit block sizes; not much beyond that. As far FPE, it can be any width you want (e.g. if you are using SHA-384 as your hash function, you can configure FPE to that size). FPE is a bit computationally costly; however it's still small compared to the cost of the ECC operations...

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Does RFC 6979 unconditionally prevent nonce-reuse attacks?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.