6

According to the polkadot.js docs, both ed25519 and ecdsa signatures are deterministic (given the message and private key, it always produces the same signature). However sr25519 is not.

I understand a nonce value is usually required to sign a message. It's the source of the randomness of the signature. We can use the RFC6979 trick in ecdsa to generate deterministic nonce, but why cannot we use the same trick in sr25519?

1 Answer 1

9

A simple sr25519 signature remains secure even with actively malicious system randomness, and you can pass in your own RngCore to have deterministic test vectors, but..

In future, schnorrkel shall support protocols like (threshold) multi-signatures which cannot be derandomized by any mechanism. I decided to rip the band-aid off and make all sr25519 signatures non-deterministic to prevent anyone depending upon determinism elsewhere.

In the code, we inherit non-determinism from merlin, which made this choice for exactly the same reasons.

In blockchains, we distinguish between on-chain (runtime) and off-chain (host) code, but only off-chain code supports secrets and system randomness. It's good we break a signer used in the runtime. There is no reasons off-chain workers cannot have system randomness and secrets, but not sure the current status.

3
  • Thanks. Very useful answer!
    – h4x3rotab
    Commented Oct 12, 2022 at 4:23
  • Could you elaborate a little bit more why Sr25119 is non-deterministic? Maybe i have been using an incorrect definition for deterministic. I can produce a multisig out of some Sr25519 addresses off-chain. Is that part deterministic? But the signing part is non-determinsitic, perhaps now i see the distinction. Commented Oct 14, 2022 at 12:25
  • An on-chain multi-sig does not care, if that's your question. Afaik we've no wallets with support off-chain cryptographic multi-sigs. We've some code in schnorrkel for this, but it needs to be replaced since I wrote it before we'd proved eprint.iacr.org/2020/1245 and thus Commented Oct 16, 2022 at 8:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.