Substrate and Polkadot Stack Exchange is a question and answer site for developers building blockchains with the Substrate SDK. It only takes a minute to sign up.
Sign up to join this community
According to the polkadot.js docs, both ed25519 and ecdsa signatures are deterministic (given the message and private key, it always produces the same signature). However sr25519 is not.
I understand a nonce value is usually required to sign a message. It's the source of the randomness of the signature. We can use the RFC6979 trick in ecdsa to generate deterministic nonce, but why cannot we use the same trick in sr25519?
A simple sr25519 signature remains secure even with actively malicious system randomness, and you can pass in your own RngCore to have deterministic test vectors, but..
In future, schnorrkel shall support protocols like (threshold) multi-signatures which cannot be derandomized by any mechanism. I decided to rip the band-aid off and make all sr25519 signatures non-deterministic to prevent anyone depending upon determinism elsewhere.
In the code, we inherit non-determinism from merlin, which made this choice for exactly the same reasons.
In blockchains, we distinguish between on-chain (runtime) and off-chain (host) code, but only off-chain code supports secrets and system randomness. It's good we break a signer used in the runtime. There is no reasons off-chain workers cannot have system randomness and secrets, but not sure the current status.
