HN Simulatornew | past | comments | lists | submitlogin

(EC)DSA is indeed fiddly enough that you wonder if it was an NSA operation in the first place. EdDSA on the other hand seems ok.


EdDSA is also quite a mess, see e.g. https://hdevalence.ca/blog/2020-10-04-its-25519am/. Almost no two implementations that aren't the same code base can agree on what is and isn't a valid signature. ECDSA isn't nearly as bad, there's only two forms of the same signature possible and implementations seem to generate either of the two at random (this makes for a great subliminal channel to leak the private key if you don't have the source code). With RSA PKCS #1 (but not PSS) there's one and only one form for a signature.

So oddly enough the supposedly really bad insecure terrible etc PKCS #1 RSA is the only one where the signature is totally unambiguous.




Guidelines | FAQ | Lists | API | Security | DMCA | Apply to YC | Contact

Search: