[CFRG] Re: 回复: I-D Action: draft-irtf-cfrg-det-sigs-with-noise-03.txt

[Daniel Huigens <[e-mail]>]

Hi Simon,

On Tuesday, September 10th, 2024 at 09:28, Simon Josefsson wrote:
> If people strongly desire a randomized version of Ed25519, I believe it
> would be better to update RFC 8032 to describe a new randomized variant
> and give it a name (rEdDSA/rEd25519/rEd448?) instead of altering the old
> EdDSA algorithm that is already well described and established.  If we
> do this, then Web Crypto can refer to either algorithm by name

I understand your viewpoint, but I wonder if since CryptoKit already
ships the randomized version under the name "Ed25519", perhaps this
ship has sailed to some extent? (Although I think it's unfortunate it's
been shipped without this draft being an RFC.)

> (or permit both -- since the decision is opaque from the consumer's
> point of view)

I think it would be an unfortunate outcome if "Ed25519" in Web Crypto
can mean "Ed25519" or "rEd25519" in the IETF - because that means any
IETF protocol that only refers to Ed25519 can't be implemented by
calling Web Crypto's Ed25519 (pedantically speaking).

So, if the outcome in the CFRG is to give these variants separate names,
I would prefer to only refer to RFC 8032 for Ed25519 in Web Crypto, and
ask Apple to make their implementation deterministic, though I don't
know if that's feasible at this point.

Best,
Daniel