Re: [Cfrg] Summary of the poll: Elliptic Curves - signature scheme: friendliness to low memory implementations (ends on June 3rd)

[Dan Brown <[e-mail]>]

So, if we're stuck with deterministic + IUF, maybe we can do reverse Schnorr, with the point being suffixes to the message instead of prefixed, and then rely on wide pipe hash without any extension‎ properties, etc., which is slightly than a simple hash (or is it?).

Sent from my BlackBerry 10 smartphone on the Rogers network.
  Original Message
From: Paterson, Kenny
Sent: Friday, June 19, 2015 6:08 PM
To: Tony Arcieri; Blumenthal, Uri - 0553 - MITLL
Cc: [e-mail]
Subject: Re: [Cfrg] Summary of the poll: Elliptic Curves - signature scheme: friendliness to low memory implementations (ends on June 3rd)


Folks,

I appreciate the input, but let's not rerun all the arguments we've
already had.

People were quite rightly asking the chairs to provide more clarity on the
result of the poll. We've now done that.

It was narrow, but option 1 had the most support.

Cheers

Kenny

On 19/06/2015 23:03, "Tony Arcieri" <[e-mail]> wrote:

>On Fri, Jun 19, 2015 at 1:24 PM, Blumenthal, Uri - 0553 - MITLL
><[e-mail]> wrote:
>
>
>Uhh, IMHO we are supposed to be practical even when paranoid. I find it
>certain that we all would be beyond caring by the time collisions are
>produced in SHA-3.
>
>
>
>
>
>
>
>
>
>
>
>
>
>As the expression goes "attacks always get better". I definitely care
>about having constructions that would survive SHA-3 collisions, and I
>also think they might pose a credible threat in the next two decades or
>so.
>
>
>I guess the counterargument is to swear off primitives with fewer sharp
>edges due to the constraints of devices that will be obsolete in a few
>years? I would prefer to have cryptographic primitives that stand the
>test of time.
>
>
>--
>Tony Arcieri
>
>
>

_______________________________________________
Cfrg mailing list
[e-mail]
http://www.irtf.org/mailman/listinfo/cfrg