Editing Digital Signature Algorithm (section)

==Sensitivity==
With DSA, the entropy, secrecy, and uniqueness of the random signature value <math>k</math> are critical. It is so critical that violating any one of those three requirements can reveal the entire private key to an attacker.<ref>{{cite web|url=http://rdist.root.org/2009/05/17/the-debian-pgp-disaster-that-almost-was/|title=The Debian PGP disaster that almost was|work=root labs rdist|date=18 May 2009 }}</ref> Using the same value twice (even while keeping <math>k</math> secret), using a predictable value, or leaking even a few bits of <math>k</math> in each of several signatures, is enough to reveal the private key <math>x</math>.<ref>[https://rdist.root.org/2010/11/19/dsa-requirements-for-random-k-value/ DSA <math>k</math>-value Requirements]</ref>

This issue affects both DSA and Elliptic Curve Digital Signature Algorithm ([[ECDSA]]) – in December 2010, the group ''fail0verflow'' announced the recovery of the [[ECDSA]] private key used by [[Sony]] to sign software for the [[PlayStation 3]] game console. The attack was made possible because Sony failed to generate a new random <math>k</math> for each signature.<ref>{{Cite news|last=Bendel|first=Mike|title=Hackers Describe PS3 Security As Epic Fail, Gain Unrestricted Access|publisher=Exophase.com|date=2010-12-29|url=http://exophase.com/20540/hackers-describe-ps3-security-as-epic-fail-gain-unrestricted-access/|access-date=2011-01-05}}</ref>

This issue can be prevented by deriving <math>k</math> deterministically from the private key and the message hash, as described by {{IETF RFC|6979}}. This ensures that <math>k</math> is different for each <math>H(m)</math> and unpredictable for attackers who do not know the private key <math>x</math>.

In addition, malicious implementations of DSA and ECDSA can be created where <math>k</math> is chosen in order to [[subliminal channel|subliminally]] leak information via signatures. For example, an [[offline private key]] could be leaked from a perfect offline device that only released innocent-looking signatures.<ref>{{cite arXiv|title=How Perfect Offline Wallets Can Still Leak Bitcoin Private Keys|first=Stephan|last=Verbücheln|date=2 January 2015|eprint=1501.00447|class=cs.CR}}</ref>