Re: [Cfrg] draft-irtf-cfrg-eddsa -- one final proposal for domain separation (context labels) for ed25519

[Simon Josefsson <[e-mail]>]

Daniel Kahn Gillmor <[e-mail]> writes:

> My goal in raising this is not to delay the process further, but to at
> least clarify for future readers why the interfaces for Ed25519 and
> Ed448 differ by a "context" argument, and to give some form of
> implementation guidance to people who want to use that argument while
> being able to use both signature schemes.

Hi Daniel, all,

I agree that is a good goal -- if you can think of text to explain this
difference I would support that it is added.

> A recent example is
> https://tools.ietf.org/html/draft-ietf-curdle-dnskey-eddsa-00, which
> defines DNSKEY records for both Ed25519 and Ed448.  I spoke to the
> authors about using a context label to avoid RRSIGs from being re-usable
> in non-RRSIG contexts.

Instead of introducing complexity (i.e., contexts), I suggest that you
recommend to not re-use the same key for different purposes!

Key re-use for different purposes is the fundamental problem as I see
it.  The idea behind context may have good intentions, but I believe
contexts is only a band-aid for the problem of cross-domain key-reuse,
and I believe that overall contexts introduce more harm than they
address.  I believe it is better to address the problem at its source.

>> So here is a suggestion.  Write a document describing a Ed25519-variant
>> called Ed25519ctx.  I would help work on it.  For those implementations
>> that are interested in using Ed25519ctx (which are they?), try to get
>> them aligned behind the document.  If there are, say, two different
>> protocols that have a desire to use contexts, I would believe that there
>> shouldn't be a problem getting the document published as an RFC.
>
> This will only further delay systems that want to use Ed25519

How so?

> or it will discourage people from even trying to distinguish between
> domains that do use Ed25519 ("don't bother, unless you use Ed25519ctx
> instead").

My point is that it is a bad idea to attempt to distinguish between
domains.

> As i wrote in my mail that started this thread, i'd be fine with just
> the addition to the security considerations explaining the distinction
> between the primitives, if that would get the draft out the door more
> promptly.  I don't want this to drag on any longer than anyone else
> does.

Thanks -- and I agree text like that would be good.  Sorry I didn't
catch this in your first email, I read it as a request to add contexts
to Ed25519.

Thanks,
/Simon