Re: [Cfrg] On the differences of Ed25519/448 and how it affects a vote on twoshakes-d

On 12/11/15 11:03 PM, Tony Arcieri wrote:
> On Fri, Dec 11, 2015 at 7:26 AM, Gilles Van Assche
> <gilles.vanassche@st.com <mailto:gilles.vanassche@st.com>> wrote:
> 
>     Another point of view could be that Ed448 and Ed448ph are still
>     distinctly-named algorithms (i.e., symmetrically with Ed25519 and
>     Ed25519ph), but thanks to the domain separation brought by twoshakes-d
>     in the internal hash they enjoy the property that a public key can be
>     certified for one, for the other or for both. As far as I have seen,
>     twoshakes-d is the only proposal so far that offers that property.
> 
> I voted for twoshakes-d for this reason, however there's something odd
> about this I think really deserves discussion...
> 
> I do not think Ed448(ph) will receive widespread use, because
> Ed25519(ph) is "good enough".
> 
> If twoshakes-d wins, Ed448 will be in the curious position of supporting
> domain separation (but hardly anyone will use it), but Ed25519 will not
> (and most people will probably use it).
> 
> This seems oddly inconsistent to me.

Interesting - I agree with most of your reasoning but it leads me to the
opposite conclusion.  Namely, this makes me feel less concerned about
Ed448 being a bit inconsistent with Ed25519 by virtue of having extra
"conservative security features" like domain separation.  While indeed
most everyone agrees that Ed25519 is probably good enough for most
purposes, Ed448's main "raison d'etre" is to have an additional/backup
alternative with even more conservative security parameters - i.e., from
"good enough" (255-bit curve) to "insane" security (448-bit curve).
From that viewpoint, it doesn't seem at all inconsistent with Ed448's
basic purpose for it to have additional conservative security features
that Ed25519 doesn't, such as explicit domain separation.

I still think it would be straightforward to back-port domain separation
to Ed25519 but don't have strong feelings either way; especially the
line of reasoning above makes me also completely comfortable with not
doing so.

Cheers
Bryan

> 
> -- 
> Tony Arcieri
> 
> 
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
> 

Re: [Cfrg] On the differences of Ed25519/448 and how it affects a vote on twoshakes-d

Attachment: smime.p7s