Re: [Cfrg] On the differences of Ed25519/448 and how it affects a vote on twoshakes-d

[Tony Arcieri <[e-mail]>]

On Sat, Dec 12, 2015 at 12:47 AM, Bryan A Ford <[e-mail]>
wrote:

> Interesting - I agree with most of your reasoning but it leads me to the
> opposite conclusion.  Namely, this makes me feel less concerned about
> Ed448 being a bit inconsistent with Ed25519 by virtue of having extra
> "conservative security features" like domain separation.  While indeed
> most everyone agrees that Ed25519 is probably good enough for most
> purposes, Ed448's main "raison d'etre" is to have an additional/backup
> alternative with even more conservative security parameters - i.e., from
> "good enough" (255-bit curve) to "insane" security (448-bit curve).
> From that viewpoint, it doesn't seem at all inconsistent with Ed448's
> basic purpose for it to have additional conservative security features
> that Ed25519 doesn't, such as explicit domain separation.


This is something I'm a bit confused about and could perhaps use some
clarification from the chairs about...

I had also originally assumed that the Ed448 hash choice(s) were a sort of
"spinal tap grade" option to switch over to in the event of a disastrous
Ed25519 failure, but...

Is it that, or is this to be a future framework for additional elliptic
curve signatures? When it comes time to standardize CFRG signatures for
e.g. FourQ, will Ed25519 be treated as legacy and the decisions around
Ed448 be treated as standard operating procedure. Or will the debate start
over from the beginning?

I think it would be nice if there were a standard signature framework that
could be used for future curves without restarting the bikeshedding debate
again from the beginning.

-- 
Tony Arcieri