Re: [Cfrg] draft-irtf-cfrg-eddsa -- one final proposal for domain separation (context labels) for ed25519

[Benjamin Kaduk <[e-mail]>]

Hmm, Ilari's messages are not making it into either my MIT or my Akamai
inbox; that's quite unfortunate.

On Thu, 21 Apr 2016, Daniel Kahn Gillmor wrote:

> On Thu 2016-04-21 15:50:14 -0400, Ilari Liusvaara wrote:
> > I actually implemented the scheme (modifying the python reference
> > implementation in the draft (modifying H(x) to be SHA512(context|x)).
> >
> > - Modified and base scheme generate identical signatures and validate
> >   identical signatures for empty context (as expected).
> > - Signature of ('abc','def') is different from signature of ('abcd','ef')
> >   and does not cross-validate. Nor does either cross-validate with
> >   ('',abcdef).
>
> Is this because you're including the NUL octet between the context and
> the signature, or for some other reason?  if so, then i'd phrase it as:
>
>  signature of ('abc\0', 'def') is different from signature of ('abcd\0', 'ef')
>
> which i think everyone would agree is the right outcome.
>
> Or are you talking about some other scheme?

I think Ilari is talking about the Ed448 scheme already describe in the
document, which uses the function:

   dom(x, y)  The octet string "SigEd448" || octet(x) ||
      octet(OLEN(y)) || y, where x is in range 0-255 and y is octet
      string of at most 255 octets.  "SigEd448" is in ASCII (8 octets).

which length-prefixes the context before including it in the signed data,
among other things.  (The dom() output is then concatenated with other
data before being passed to SHAKE256 as H(x).)


> > [ben kaduk wrote:]
> >> From where I am sitting, it seems like there are two options: does
> >> the signing API include a context input?  If yes, use that input; if
> >> no, prepend the context to the message to be signed in my own code.
> >> What am I missing?
> >
> > This does not work.
>
> Why not?  Can you explain more?

I think we all need to be more clear about whether we are talking about
the existing Ed448 context scheme, or the bits in
http://unicorn-wg.github.io/context-labels/ .

My comments in this thread have centered on the latter.

-Ben