Re: [Cfrg] draft-irtf-cfrg-eddsa -- one final proposal for domain separation (context labels) for ed25519

On Tue, May 10, 2016 at 2:16 AM, Simon Josefsson <simon@josefsson.org> wrote:
> Martin Thomson <martin.thomson@gmail.com> writes:
>
>> On 6 May 2016 at 20:17, Ilari Liusvaara <ilariliusvaara@welho.com> wrote:
>>>
>>> So yeah, just use separate keys. Don't cause problems for everybody
>>> by using contexts.
>>
>> As an author of a document that defines the use of contexts, how do
>> you reconcile this view with what the document says?
>
> Hi Martin.
>
> The difference between personal opinion and group consensus decisions?
> I'm just speculating what Ilari's reasons are though.
>
>> But I see those examples as illustrative of an insufficient degree of
>> redundancy.  For, if ever there were fans of redundancy, it would be
>> the military.  While conceivably you could build a protocol that
>> defers all self-identification and context to the crypto that supports
>> it, in the cases illustrated, it shows itself as unwise in the extreme
>> in light of the propensity of people to do bad things.
>
> I suspect there is fundamental disagreement between fans of redundancy
> and fans of lesser complexity.
>
> In my experience, redundancy (=complexity) in security systems have too
> many time been used as a way to get through the system.  Redundancy can
> act as a slowdown factor and mitigator, but if your primitives are weak
> then you are vulnerable no matter what.  The academic optimistic view
> appears to be that it should be possible to find strong primitives, and
> to trust that they are strong.  History shows that everything is broken
> eventually, but history hasn't killed the optimism.

Let's consider an actual protocol, TLS 1.3. TLS 1.3 cannot rely on the
context mechanism of Ed25519ctx because it must work with RSA
signatures as well. Introducing contexts won't actually make it more
secure so long as it has to work with RSA. But introducing contexts
will force everyone to complicate their implementation, which we know
leads to bugs.

>
> My thoughts are that it is possible to achieve what the proponents of
> redundancy (contexts) want and please the people who want the least
> complexity, at the same time.  Just define a low-level primitive like
> Ed25519 as it is, and deal with higher-level aspects like
> cross-protocol/domain mitigators at the protocol level, or at another
> crypto primitive (ed25519ctx) which can be opt-in by the people who have
> drunk that particular Kool-Aid.
>
> Thanks,
> /Simon
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>

-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.