Re: [Cfrg] Signatures: curves, algorithms, etc

On Tue, Jan 27, 2015 at 1:33 PM, Tony Arcieri <bascule@gmail.com> wrote:
> I would like to hear the opinions of the chairs and other CFRG participants
> on the following:
>
> - Ed25519 and EdDSA
> - FrankenECDSA (ECDSA in Edwards)
> - ECDSA with Edwards keys on the wire (converted to Weierstrass to do ECDSA)
> - Other interesting thoughts on digital signatures

Batch verification is potentially a real win for performance in common
uses of X509.3. This isn't possible with ECDSA. Of course, it requires
issuing the root, intermediate, and end-party cert with the same exact
curve. I can imagine where we use a short-lived (1 year or so)
intermediate with Ed25519, and cache it to enable batch verification
without the concerns with roots with Ed25519.

On the other hand the security issues of existing software are less
significant for signing.

I think we will need to parameterize over hash functions, potentially
with output smaller than liked.
Sincerely,
Watson Ladd

>
>
> --
> Tony Arcieri
>
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg
>

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin