Hector Martin

Do I understand correctly that if deterministic signature algorithm was chosen, this problem wouldn't be that huge?

Yes.

Oh, people never learn...

To be fair, Yubico doesn't get to pick what curves they need to implement for a given standard.

Deterministic nonce generation is possible for all curves, isn't it? Besides, mandating possibly flawed curves is quite bad idea but maybe it's due to back compat.

It is, but it isn't the standard for most curves, and *especially* for a FIPS device I doubt they could get away with doing that. Most standards are still using horrid NSA curves, even U2F. Only very recently is ed25519 expanding beyond the space of open source software.

Wouldn't it be possible to implement deterministic nonce generation, but XOR those bits with what should have been random bits for the FIPS version? That way, even *if* FIPS nonce randomness fails, you'd still be safe because the private key was used to key the MAC for nonce gen.