Would it be possible to have OpenSSL support generation of ECDSA signatures
in a deterministic manner?

This would be necessary to implement RFC6962-bis. Specifically, Section
12.4 (draft 21) requires the use of deterministic signatures (

The rationale behind it is to prevent fingerprinting/tracking of TLS
clients by producing Signed Tree Heads / Signed Certificate Timestamps with
the same data but different signatures, then tracking propagation of these
SCTs / STHs via gossip protocols.

openssl-dev mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev

Reply via email to