Re: [Cfrg] Elliptic Curves - signature scheme: friendliness to low memory implementations (ends on June 3rd)

[Ilari Liusvaara <[e-mail]>]

On Sun, Jun 07, 2015 at 11:38:26PM -0700, Andrey Jivsov wrote:
> 
> It follows that GnuPG signing method always depends on collision resistance
> of the hash function, (always with ECDSA, and always with EdDSA). This means
> that the 2 extra hashings done in the EdDSA sign function don't buy much (at
> least they don't free one from using a collision resistant function).

Yes, those two don't free from having to have CR hash function, however, what
those do is:

- Not having to do "nonce" generation involving random numbers (which has
  a long history of trainwrecks).
- Not having to do divisions mod order. Divisions mod order when verifying are
  annoying, divisions mod order when signing are dangerous.

And besides, both "extra" hashes look to be just one SHA-512 block if hash
algorithm is SHA-256.

And signing long messages like CMS and OpenPGP do is more of an exception.
Most signing is of short messages.


-Ilari