Re: [Cfrg] Poll: hash functions for Ed448 (ends on December 22nd)

[Simon Josefsson <[e-mail]>]

My thinking is:

twoshakes-s: 0
twoshakes-d: -1 (complexity!)
simon1: 1 (simplicity, conservative, consistency with ed25519)
simon2: 0
ilari1: 0
ilari2: 0

I have started to feel that the fact that we can have this poll with no
real-world feedback from experience with deployed Ed448 implementations
is a sign that standardizing Ed448 is premature.  There simply appears
to be little interest from implementers, at least from what I can see
From my perspective.  I suppose it may be too late to back down from
this tree though.

/Simon

Alexey Melnikov <[e-mail]> writes:

> This message starts 2 weeks Quaker Poll on hash functions to be used
> for definition of Ed448 in draft-irtf-cfrg-eddsa. Please reply for
> each choice:
> +1, if you prefer a particular choice
> 0, if you can live with it
> -1, if you are against a particular choice
>
> Choices are:
>
> 1) "twoshakes-s", (SHAKE256@912(x) for the internal hash,
> SHAKE256@512(x) as the prehash)
>
> More details:
> <http://www.ietf.org/mail-archive/web/cfrg/current/msg07629.html>
>
> 2) "twoshakes-d",
>
> This scheme again uses the SHAKE256 extensible-output functions (XOFs)
> to implement both hashes, with the inputs prefixed as specified below
> for explicit domain separation purposes.
>
> More details:
> <http://www.ietf.org/mail-archive/web/cfrg/current/msg07629.html>
>
> 3) "simon1" (SHAKE256@912(x) for the internal hash, SHA3-512 as the
> prehash).
>
> 4) "simon2" (Use SHA2-512/912 as described in [1] as the internal hash
> and SHA2-512 as the prehash).
>
> [1] - <http://ed25519.cr.yp.to/eddsa-20150704.pdf>
>
> 5) "ilari1" (SHAKE256@912bits(x) for the internal hash, SHA2-512(x) as
> the prehash)
>
> More details:
> <http://www.ietf.org/mail-archive/web/cfrg/current/msg07644.html>
>
> 6) "ilari2"
>
> Hash: HKDF-EXPAND(hash=SHA2-512, prk=HKDF-EXTRACT(hash=SHA2-512,
> salt=<blank>, ikm=x), info=<blank>, 114) Prehash: SHA2-512(x)
>
> More details:
> <http://www.ietf.org/mail-archive/web/cfrg/current/msg07644.html>
>
> 7) You can specify an alternative proposal, if you wish
>
> Best Regards,
> Kenny and Alexey
>