Re: [Cfrg] Ed448 hash choice

[Björn Edström <[e-mail]>]

I like the idea of a time fixed poll to keep the work moving forward.
Kenny, Alexey?

(Also +1 for changing everything to big endian ;-)).

Cheers
Björn


On Thu, Oct 22, 2015 at 12:32 PM, Simon Josefsson <[e-mail]> wrote:
> Björn Edström <[e-mail]> writes:
>
>> I'm gonna chime in with my two cents and vote for option 1, that is
>> SHAKE256 internally and SHA3-512 for the pre-hash. Ed25519 should be
>> left as-is.
>
> Maybe we can do a poll for complete Ed448 hash proposals to consider,
> with a fixed timeline, and then a poll between these proposals, also
> with a fixed timeline?  That seems to be one way of proceeding.
>
>> I don't have super strong opinions on the above from a technical merit
>> and I will not sleep bad at night if another option is decided. I am
>> however getting quite strong opinions that a decision should be made
>> soon before a hundred more emails will be written on this (slightly
>> bikeshed-y) topic. :-)
>
> We haven't discussed nearly as long as endianness yet. :-)
>
>> 4) I believe that regardless of what is recommended for Ed448ph,
>> people will use Ed448 on hashes in various ways anyway. So personally
>> I see Ed448ph more of a recommendation than a construct that really
>> needs to be specified to the same extent as Ed448. It could very well
>> be the case that the committee decides on one pre-hash and it will be
>> used completely differently in TLS.1.3 should TLS 1.3 get support for
>> a cipher suite with Ed448. So I don't think that the discussions about
>> what will happen with TLS 1.3 are relevant enough to change the work
>> on this draft.
>
> It may be that TLS uses Ed25519/Ed448 directly instead of
> Ed25519ph/Ed448ph too.  I don't believe pre-hashing make sense for
> interactive TLS-like protocols that sign short messages.
>
> /Simon