Re: [Cfrg] I-D Action: draft-irtf-cfrg-eddsa-03.txt

Hi Simon and Ilari,

I’m working to implement the draft, and I’m curious about the Ed448ph test vectors.

They set the private key to 32 bytes:
   833fe62409237b9d62ec77587520911e
   9a759cec1d19755b7da901b96dca3d42

However, the spec says that "The secret key is 57 octets (456 bits, corresponding to b) of cryptographically-secure random data."

It would of course be secure to use a key length other than 57 bytes for Ed448, prehashed or otherwise.  It’s only the seed to an expansion hash, and could be set at 32 octets without losing meaningful security (or even 28 octets in the single-key setting, but this loses security against multi-key attacks).  However, the spec seems to require 57 bytes.

Is the test vector missing some bytes, or are Ed448 keys allowed to be other lengths?

Thanks,
— Mike

> On Mar 1, 2016, at 12:41 PM, Paterson, Kenny <Kenny.Paterson@rhul.ac.uk> wrote:
> 
> Hi Ilari,
> 
> Many thanks to you and Simon for your efforts in moving this ID forwards.
> 
> Folks reading on the list: we are very keen to get your input on this
> draft as we close out our work on signatures. If you have the expertise,
> please read carefully and let us know about any nits or other issues you
> find.
> 
> Thanks
> 
> Kenny 
> 
> On 01/03/2016 20:35, "Cfrg on behalf of Ilari Liusvaara"
> <cfrg-bounces@irtf.org on behalf of ilariliusvaara@welho.com> wrote:
> 
>> On Tue, Mar 01, 2016 at 12:30:45PM -0800, internet-drafts@ietf.org wrote:
>>> 
>>> A New Internet-Draft is available from the on-line Internet-Drafts
>>> directories.
>>> This draft is a work item of the Crypto Forum of the IETF.
>>> 
>>>        Title           : Edwards-curve Digital Signature Algorithm
>>> (EdDSA) 
>>>        Authors         : Simon Josefsson
>>>                          Ilari Liusvaara
>>> 	Filename        : draft-irtf-cfrg-eddsa-03.txt
>>> 	Pages           : 52
>>> 	Date            : 2016-03-01
>>> 
>>> Abstract:
>>>   The elliptic curve signature scheme Edwards-curve Digital Signature
>>>   Algorithm (EdDSA) is described.  The algorithm is instantiated with
>>>   recommended parameters for the edwards25519 and edwards448 curves.
>>>   An example implementation and test vectors are provided.
>>> 
>>> The IETF datatracker status page for this draft is:
>>> https://datatracker.ietf.org/doc/draft-irtf-cfrg-eddsa/
>>> 
>>> There's also a htmlized version available at:
>>> https://tools.ietf.org/html/draft-irtf-cfrg-eddsa-03
>>> 
>>> A diff from the previous version is available at:
>>> https://www.ietf.org/rfcdiff?url2=draft-irtf-cfrg-eddsa-03
>>> 
>> 
>> Posted a new version that tries to address the RGLC comments and also
>> refrormats the parameter tables to be hopefully clearer.
>> 
>> 
>> (Had to work around some issues with the XML... Hopefully the result
>> looks sane).
>> 
>> 
>> 
>> -Ilari
>> 
>> _______________________________________________
>> Cfrg mailing list
>> Cfrg@irtf.org
>> https://www.irtf.org/mailman/listinfo/cfrg
> 
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg