Re: [CFRG] I-D Action: draft-mattsson-cfrg-det-sigs-with-noise-04.txt

[Simon Josefsson <[e-mail]>]

Hi

I believe this document should not update/modify the core EdDSA/ECDSA
algorithms but instead it should specify new names for the alternative
EdDSA/ECDSA variant it is attempting to introduce.

It would cause confusion to modify a tiny but security-critical piece of
a crypto algorithm, that is only applicable to certain environments, and
continue to use the same name for the new algorithm that has different
security properties.

I suggest using the name 'R* for the variants, e.g., 'REd25519ph',
'REd25519ctx', 'REd25519 etc.

Then any IoT specification that wants to use the REd25519 variant can do
so clearly, and those specifications/implementations that do not want to
use it is not put at risk by using a library that implements 'Ed25519'
that happened to have adopted this modification.

/Simon

John Mattsson <john.mattsson=[e-mail]> writes:

> Hi,
>
> We have updated based on the comments received during the adoption call as well as errata pointed out more recently on the list:
>
> - Ilari Liusvaara and Ruggero Susella pointed out that the draft mixes up bits and bytes in some places. Carsten Bormann commented on bytes vs. octets. The -04 version used only "octets" to align with RFC 8032.
>
> - Ilari pointed out that context might be bigger than 128 bytes. Changed to multiple of 128/136 octets.
>
> - Jim Schaad expressed strong support for the use of KMAC together with SHAKE. Support also from Janos Follath. -04 added a new paragraph stating that HMAC MAY be used but KMAC is RECOMMENDED when SHAKE is used.
>
> - Added a sententence that detminitic signatures are not secure in multi-sing setting with a reference to FROST.
>
> - Based on a comment from Phillip Hallam-Baker more text on benefits with deterministic signatures was added "This makes verification of implementations easier."
>
> - Based on a comment from Jim Schaad it was added clearly early in the document that the updates are "invisible to the validator of the signature.". Makes me sad that this was very likely the last time I added Jim's name to an Acknowledgments section....
>
> Comments and issues that have not been addressed yet are summarized in Section 6 of the draft.
>
> Cheers,
> John
>
>
> From: CFRG <[e-mail]> on behalf of [e-mail] <[e-mail]>
> Date: Tuesday, 15 February 2022 at 14:54
> To: [e-mail] <[e-mail]>
> Cc: [e-mail] <[e-mail]>
> Subject: [CFRG] I-D Action: draft-mattsson-cfrg-det-sigs-with-noise-04.txt
>
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Crypto Forum RG of the IRTF.
>
>         Title           : Deterministic ECDSA and EdDSA Signatures with Additional Randomness
>         Authors         : John Preuß Mattsson
>                           Erik Thormarker
>                           Sini Ruohomaa
>         Filename        : draft-mattsson-cfrg-det-sigs-with-noise-04.txt
>         Pages           : 16
>         Date            : 2022-02-15
>
> Abstract:
>    Deterministic elliptic-curve signatures such as deterministic ECDSA
>    and EdDSA have gained popularity over randomized ECDSA as their
>    security do not depend on a source of high-quality randomness.
>    Recent research has however found that implementations of these
>    signature algorithms may be vulnerable to certain side-channel and
>    fault injection attacks due to their determinism.  One countermeasure
>    to such attacks is to re-add randomness to the otherwise
>    deterministic calculation of the per-message secret number.  This
>    document updates RFC 6979 and RFC 8032 to recommend constructions
>    with additional randomness for deployments where side-channel attacks
>    and fault injection attacks are a concern.  The updates are invisible
>    to the validator of the signature and compatible with existing ECDSA
>    and EdDSA validators.
>
>
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-mattsson-cfrg-det-sigs-with-noise/
>
> There is also an HTML version available at:
> https://www.ietf.org/archive/id/draft-mattsson-cfrg-det-sigs-with-noise-04.html
>
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-mattsson-cfrg-det-sigs-with-noise-04
>
>
> Internet-Drafts are also available by rsync at rsync.ietf.org::internet-drafts
>
>
> _______________________________________________
> CFRG mailing list
> [e-mail]
> https://protect2.fireeye.com/v1/url?k=31323334-501d5122-313273af-454445555731-40f7d10cf9eb7c69&q=1&e=6e59d256-d95c-4d1c-8fc5-606ff8918ce3&u=https%3A%2F%2Fwww.irtf.org%2Fmailman%2Flistinfo%2Fcfrg
> _______________________________________________
> CFRG mailing list
> [e-mail]
> https://www.irtf.org/mailman/listinfo/cfrg
>