Deterministic signatures are not your friends

Deterministic signatures are praised as the pinnacle of Elliptic Curve Cryptography. ed25519 uses them. RFC 6979 spec describes them. They eliminate the whole class of issues with “bad randomness”. Turns out, with recent CVE in elliptic.js , which allowed attackers to extract private keys, full determinism is not great. How signatures are made? Extracting keys using bad randomness Extracting keys…