MIME-Version: 1.0
References: <CAPg+sBgxvRM5ncQAnbNLN=4bdkQrM+-DxibMoTG+6gqk7EY9hQ@mail.gmail.com>
 <CAMZUoKkAebw6VzSco3F+wnLptNwsCiEw23t2pLj0xitiOSszMQ@mail.gmail.com>
In-Reply-To: <CAMZUoKkAebw6VzSco3F+wnLptNwsCiEw23t2pLj0xitiOSszMQ@mail.gmail.com>
From: "Russell O'Connor" <roconnor@blockstream.com>
Date: Tue, 25 Feb 2020 22:26:42 -0500
Message-ID: <CAMZUoK=RDkNZM=hSZu2OMoH1y=nrx57weefu1ow8ZnX7wSOErw@mail.gmail.com>
To: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary="00000000000007aec8059f722d96"
Subject: [bitcoin-dev] Fwd:  BIP 340 updates: even pubkeys,
	more secure nonce generation
Precedence: list

--00000000000007aec8059f722d96
Content-Type: text/plain; charset="UTF-8"

On Sun, Feb 23, 2020 at 11:26 PM Pieter Wuille via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> wrote:

>
> 2. Nonce generation
>
> All other semantical changes are around more secure nonce generation
> in BIP 340, dealing with various failure cases:
>
> * To protect against fault injection attacks it is recommended to
> include actual signing-time randomness into the nonce generation
> process. This was mentioned already, but the update elaborates much
> more about this, and integrates this randomness into the standard
> signing process.
>

I do worry that standardizing on a non-deterministic nonce generation
scheme makes the problem of private key exfiltration a much bigger concern
in the application of hardware signing devices.
While sorely imperfect, with a deterministic nonce scheme, we at least have
the option of spot checking hardware devices to see if they are producing
signatures in accordance with their specified nonce scheme.  But short of
providing some kind of certificate, we won't be able to do such checks
against hardware devices that use the proposed synthetic nonce. (Question:
can a hardware device safely output the random value 'a' it used its
"certificate"?  AFAIU 'a' is not considered secret data; it just needs to
be not under attacker control.  Should hardware wallets be encouraged to
return this value?)

The best way to mitigate this is to use the Nonce exfiltration protection
mentioned; however there are no references on how to do this.  Ideally we'd
standardize this Nonce exfiltration protection scheme within this synthetic
nonce scheme.  However, I don't think it is worth holding this BIP up on
that; it seems reasonable to introduce a new section to this BIP addressing
that problem in the future.  Maybe instead we can get references to more
information about this Nonce exfiltration protection that is mentioned?

Really I just want to do whatever we reasonably can do to avoid a world
where we end up providing hardware signing devices with a hard to detect
underhanded communications channel.

--00000000000007aec8059f722d96
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">On Sun, Feb 23, 2020 at 11:26 PM Pieter Wuille via bitcoin=
-dev &lt;<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org" target=3D=
"_blank">bitcoin-dev@lists.linuxfoundation.org</a>&gt; wrote:<br><div class=
=3D"gmail_quote"><div dir=3D"ltr"><div class=3D"gmail_quote"><blockquote cl=
ass=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid=
 rgb(204,204,204);padding-left:1ex"><br>
2. Nonce generation<br>
<br>
All other semantical changes are around more secure nonce generation<br>
in BIP 340, dealing with various failure cases:<br>
<br>
* To protect against fault injection attacks it is recommended to<br>
include actual signing-time randomness into the nonce generation<br>
process. This was mentioned already, but the update elaborates much<br>
more about this, and integrates this randomness into the standard<br>
signing process.<br></blockquote><div><br></div><div>I do worry that standa=
rdizing on a non-deterministic nonce generation scheme makes the problem of=
 private key exfiltration a much bigger concern in the application of hardw=
are signing devices.</div><div>While sorely imperfect, with a deterministic=
 nonce scheme, we at least have the option of spot checking hardware device=
s to see if they are producing signatures in accordance with their specifie=
d nonce scheme.=C2=A0 But short of providing some kind of certificate, we w=
on&#39;t be able to do such checks against hardware devices that use the pr=
oposed synthetic nonce. (Question: can a hardware device safely output the =
random value &#39;a&#39; it used its &quot;certificate&quot;?=C2=A0 AFAIU &=
#39;a&#39; is not considered secret data; it just needs to be not under att=
acker control.=C2=A0 Should hardware wallets be encouraged to return this v=
alue?)</div><div><br></div><div>The best way to mitigate this is to use the=
 Nonce exfiltration protection mentioned; however there are no references o=
n how to do this.=C2=A0 Ideally we&#39;d standardize this Nonce exfiltratio=
n protection scheme within this synthetic nonce scheme.=C2=A0 However, I do=
n&#39;t think it is worth holding this BIP up on that; it seems reasonable =
to introduce a new section to this BIP addressing that problem in the futur=
e.=C2=A0 Maybe instead we can get references to more information about this=
 Nonce exfiltration protection that is mentioned?</div><div><br></div><div>=
Really I just want to do whatever we reasonably can do to avoid a world whe=
re we end up providing hardware signing devices with a hard to detect under=
handed communications channel.<br></div></div></div>
</div></div>

--00000000000007aec8059f722d96--