Re: [Cfrg] Elliptic Curves - signature scheme: friendliness to low memory implementations (ends on June 3rd)

[Ilari Liusvaara <[e-mail]>]

On Tue, May 26, 2015 at 05:32:49PM +0000, David Leon Gil wrote:
> > Finally, it should be noted that most of the security stuff in IETF
> > protocols assume that signatures are "deteched" (TLS
> > syntax even has a "macro" for that), and will not work with
> > "sealed" signatures.
> 
> I'm curious what the issue is here? (Maybe I don't understand what you mean
> by "sealed"...)

"Detached" signatures:
Sign: PrivKey x Message -> Signature
Verify: PubKey x Message x Signature -> Good or Bad.

(This is the usual mode)

"Sealed" signatures:
Sign: Privkey x Message -> Signed message
sign_open: Pubkey x Signed message -> Message or Bad.

(This is mostly seen in NaCl library[1])

> I'm also not sure why bad decisions from the past should be left
> uncorrected: a history, however long, of poor design choices is not a
> *reason* to continue to make them.

The problem is that trying to "fix" things like TLS to work would
be pretty nasty, given that those protocols were designed to use
"detached" signatures.


[1] I think the stock one offers just this, and most clones have
both this and ordinary "detached" ones).


-Ilari