Re: [Cfrg] Task looming over the CFRG

[Johannes Merkle <[e-mail]>]

Watson,

> Digital signatures is a bit hairy because of the issue of certs: you
> end up needing to support more curves than you would think you would
> going in. But yes, we should discuss adopting more Schnorr-like
> mechanisms then ECDSA: the patents that forced ECDSA to look the way
> it did are long gone. However, that's not what the current TLS draft
> is about: it's purely addressing key exchange. Certificate changes
> will be a bit more work.
> 
While I agree that Schnorr-like signatures (potentially deterministic) have slight advantages over ECDSA, the discussion
on the signature scheme is a different topic, isn't it? Most ECDSA implementations could be easily adopted to twisted
Edwards curves (or any other elliptic curve representations for that matter) by exchanging the underlying curve
arithmetic, without any change in the code implementing the signature algorithm.

I am not even sure, if using ECDSA over twisted Edwards curves requires new signature algorithm OIDs and ASN1 syntax.
The signature consists of two integers r and s, only the public key and the curve parameters need to be re-interpreted.

-- 
Johannes