Re: [Cfrg] Summary of the poll: Elliptic Curves - signature scheme: friendliness to low memory implementations (ends on June 3rd)

[Andrey Jivsov <[e-mail]>]

On 06/19/2015 04:02 PM, Alyssa Rowan wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> On 2015-06-19 21:46, Alexey Melnikov wrote:
>
>> Just a reminder that CFRG is not trying to rubber-stamp any
>> particular signature algorithm.
>
> Naturally, I'm just saying: the further we diverge from something
> people already recognise as good, the more we'll need make sure to
> justify that divergence to scrutiny, or they might not want to use it.
>
>
> On 2015-06-19 19:04, Blumenthal, Uri - 0553 - MITLL wrote:
>> it is much more *usable* and *practical* that EdDSA(m).
>
> Of course the TLS WG, as implementers, get the last word on what is
> usable and practical for them.
>
> I was simply pointing out that OpenSSH have deployed EdDSA(m) with
> absolutely no troubles, and so have GnuPG, which have large messages.
> It worked for them, so I don't think it's a huge concern in practice?

No, OpenPGP uses EdDSA(H(m)) only, i.e. it relies on IUF and doesn't use 
the "high security" option, I believe exactly to avoid "troubles".

http://www.ietf.org/mail-archive/web/cfrg/current/msg06923.html

>
> But I also accept #1 is easier to shoe-horn into, say, PKCS#11, and
> agl's articulated the precise scenario underlying my discomfort with #3.
>
...