Re: [Cfrg] draft-irtf-cfrg-eddsa -- one final proposal for domain separation (context labels) for ed25519

[Martin Thomson <[e-mail]>]

On 22 April 2016 at 19:16, Ilari Liusvaara <[e-mail]> wrote:
> On Fri, Apr 22, 2016 at 05:26:37PM +1000, Martin Thomson wrote:
>> On 22 April 2016 at 16:21, Ilari Liusvaara <[e-mail]> wrote:
>> > H(x)=SHA512(context|x) does not cause behaviour like Ed25519(key,context|x)
>> > when applied.It causes behaviour that can't be expressed using the base
>> > Ed25519 primitive.
>>
>> I don't know why we got hung up on that concept.  PH(x) =
>> SHA512(context || x) might be closer to what we've been thinking of.
>
> 1) That only 'works' with Ed25519ph. And even with that, you do not
> want the context inside data hash.

I don't know what you want, but maybe you could tell me why I don't want that.

> 2) You definitely do not want that kind of context schemes on non-
> context keys. Even the prepending the context in hash (without
> separation) makes me VERY uneasy.

Well, it's how everyone is forced to do things if the primitive
doesn't have native contexts.  I agree that it could be better, but
I'm not going to lose sleep over it.

I'm having a hard time understanding what you want out of this
conversation.  Maybe you could try to explain whether you think that
context is a good idea and maybe how you would prefer that we solve
the problem.