Re: [Cfrg] Interest in an "Ed25519-HD" standard?

> On Mar 22, 2017, at 9:47 PM, Tony Arcieri <bascule@gmail.com> wrote:
> 
> On Tue, Mar 21, 2017 at 9:00 PM, Phillip Hallam-Baker <phill@hallambaker.com> wrote:
> You can do hierarchical key derivation in Montgomery without the need for an add.
> 
> Say your master key is x. To generate a key for site 'example.com' we take 
> 
> xs = (x + H('example.com')) mod q
> 
> Where q is the sub group order.
> 
> In fact that isn't really using any EC relevant operation at all. Perhaps I am not understanding the full requirements for the scheme.
> 
> One of the goals of the scheme is unlinkability: given a set of candidate keys, some of which are children of the same parent key, and others randomly generated, an attacker should not be able to do better than chance in determining which keys in the candidate set have the same parents.

From a potentially naïve reading of this thread, it sounds like the HKDF construction (the one proposed by Hugo Krawczyk and used by Signal and TLS 1.3, among others) satisfies all of the properties requested by “hierarchical key derivation” systems. Is this right or am I missing something?

Thanks,
Nadim

> 
> For example, Tor hidden services will be identified by constantly rotating "epoch keys". To find the "epoch key" for a given hidden service, a user in possession of the parent public key derives a child key offline from the parent key. However, it'd be undesirable for someone not in possession of the parent key to be able to link the child epoch keys together and enumerate hidden services without knowledge of their parent public keys.
> 
> In your scheme, given z=H("example.com"), and a parent key xG, the derived child key would be (x+z)G. To recover the original parent public key, you can simply subtract out zG and recover xG. To prevent this from happening we need to use an operation which is not easily reversible, hence multiplication
> 
> -- 
> Tony Arcieri
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg