[Cfrg] Help with the use of contexts

[Sean Turner <[e-mail]>]

Hi CFRG,

The TLS WG is nearing the end of our journey moving EC-based algorithms for TLS 1.2 (and earlier) from Informational to Standards track [0].  While we were doing that we also added in 25519 and x448 as well as EdDSA.

I’d like to get some input from the CFRG on the use of contexts; the "context label" is a way to provide domain separation between signatures made in different contexts, avoiding cross-protocol attacks.  s10.3 of draft-irtf-cfrg-eddsa includes the following:

Contexts SHOULD NOT be used opportunistically, as that kind of use
is very error-prone.  If contexts are used, one SHOULD require all
signature schemes available for use in that purpose support
contexts.

This is great advice for new protocols because it’s easy to make all the schemes the same, but for existing protocols like TLS where there’s zero chance of obsoleting the existing signature schemes and defining new signature schemes with contexts it makes you wonder what “opportunistically” means. I.e., would setting a context parameter for Ed448 and no other already defined signature scheme be considered opportunistic?

spt
(as document Shepherd for draft-ietf-tls-rfc4492bis)

[0] https://datatracker.ietf.org/doc/draft-ietf-tls-rfc4492bis/