Re: [Cfrg] On the differences of Ed25519/448 and how it affects a vote on twoshakes-d

[Ilari Liusvaara <[e-mail]>]

On Sat, Dec 12, 2015 at 01:14:00PM +0100, Bryan Ford wrote:
> On Dec 12, 2015, at 12:14 PM, Ilari Liusvaara <[e-mail]> wrote:
> > This brings to mind the following (bit crazy):
> > 
> > - Leave Ed25519 as is.
> > - Drop Ed25519ph
> > - Add Ed25519dom, with context and hash-signing capabilities.
> > - Drop Ed448ph
> > - Rename Ed448 to Ed448dom, with context and hash-signing capabilties.
> 
> This seems like a potentially pretty reasonable "sweet spot" compromise between the semi-conflicting goals of (a) domain separation, (b) alignment between Ed448 and Ed25519, and  (c) backward compatibility with current Ed25529 uses without prehashing or domain separation. 
> 
> The one downside I see is that "pure" Ed25519 wouldn't be domain-
> separated from ed25519dom, i.e., signatures generated with the former
> could in principle get misinterpreted as the latter and vice versa.
> But this is probably a small risk we can live with for backward-
> compatibility reasons. 

Those two would be separated at key level (like Ed25519 and Ed25519ph
are currently).

And hash-signing capabilities imply that separation is one-sided only
(prehash does not have domain prefix). Omitting the separation on
the other side won't cause problems because all info to generate the
prefixes is either public or requires knowledge of the private key.

And lack of IUF on domain is not a problem either, since domains are
supposed to be short.


-Ilari