[CFRG] Re: Silithium - A Compact, Efficient and Non-separable Hybrid Signature

[John Mattsson <[e-mail]>]

>That's only because Ed25519 uses SHA-512 internally, right?


Yes,


>Sillithium doesn't use Ed25519 as a black-box, if I understand correctly (which
>seems like a implementation challenge).


Agree. If hybrids are viewed as a short-term migration step, an advantage of Mothma is that it treats Ed25519 as a black-box.


>I believe the point of using hybrids is to continue using old crypto as
>a black-box in parallel with new crypto, in a safe way. A hybrid that
>doesn't re-use traditional crypto as a black box seems esoteric to me.


There seem to be different opinions about the purpose of hybrids. The more obsolete cryptographic components PQ/T hybrids rely on, the more important it is to enable a migration path for removing those components once they become pure overhead and no longer provide meaningful security. In my view that will happen sometime around 2035.


The importance and role of hybrids are fundamentally different in 2015, 2025, and 2035. I would broadly map these periods to what ANSSI calls phases 1, 2, and 3, while noting that ANSSI has not specified a date for the transition from phase 2 to phase 3. I think too much of the IETF hybrid discussion is stuck in 2015 (phase 1).


Cheers,
John Preuß Mattsson


On 2026-07-16, 08:57, "Simon Josefsson" <simon=[e-mail]> wrote:

John Mattsson <john.mattsson=[e-mail] <9c0da85e-d215-4934-bc93-5999a38ce095>> writes:


> One difference is that Mothma-Ed25519-ML-DSA-65 requires retaining
> SHA-2, whereas Silithium (which I assume can be used with
> edwards25519) can be implemented using only SHA-3.


That's only because Ed25519 uses SHA-512 internally, right? Sillithium
doesn't use Ed25519 as a black-box, if I understand correctly (which
seems like a implementation challenge). Would a Ed25519 variant using
SHAKE256 be relevant? There is already Ed448 that do not use SHA2. I'm
not convinced any of the SHA2 weaknesses even apply to Ed25519.


> If people plan to use hybrids long-term, that is an advantage for
> Silithium.


I believe the point of using hybrids is to continue using old crypto as
a black-box in parallel with new crypto, in a safe way. A hybrid that
doesn't re-use traditional crypto as a black box seems esoteric to me.


/Simon