- It requires cryptographic randomness for each individual signature;
- As a NIST standard, it is defined over the NIST elliptic curves, which are not particularly implementation-friendly;
- The standards give little to no guidance on implementation issues;
- It is slower than necessary, requiring inversions during signing.
DSA was a step backwards from the Schnorr scheme, which was the superior option at the time. The blog post (but not the ed25519 paper) seems to forget that Schnorr was never practically adopted due to patent issues, similarly to IDEA, OCB, and many other schemes left on the patented algorithm wasteland. Legend goes that the DSA was designed with the express purpose of avoiding Schnorr's patent, while still resulting in a similar scheme. Since the patent expired in 2008, this is no longer a concern, and certainly not for a signature scheme designed in 2011.
This is false. Although the default algorithm does work that way, RFC6979 lets you do ECDSA entirely with pseudorandom numbers seeded by the message and key.
http://tools.ietf.org/html/rfc6979 https://bitcointalk.org/index.php?topic=285142.0
The overwhelming majority of ECDSA applications do not use deterministic DSA; deterministic DSA is a novelty.
I don't quite understand the "Eliminate divisions" step, which transforms
B^H(R,M) = A R^S
into
B^S = R A^H(R,M)
How are these two related?
At the next step, he's giving a completely new formula that looks similar: B^S = R * A^H(R,M) = B^r * B^a^H(R,M). However, this one is solved by S = r+a*H(R,M), which is a much easier thing to calculate, since there are no divisions.
> The ElGamal signature system: BH(M) = AR RS.
H = hash, M = message, S = secret... What about all the others? I'll spend some time today reading more about this, if anybody has suggestions where to start I'd be grateful.
Meta: this has front page for more than an hour but has no comments, are you 54 up-voters reading it?
Note that those equations are only covering the verification part of the scheme.
Yes, but I can't add anything intelligent to this article at all! :-)
