Re: [Cfrg] 8032(PureEdDSA) question

[Tony Arcieri <[e-mail]>]

On Fri, Dec 21, 2018 at 8:16 AM Dan Brown <[e-mail]> wrote:

> My suggestion would be *either* to amend the main claims as
>
> "The collision resilience property means EdDSA is secure even if it is
> feasible to compute collisions for the hash function, provided the hash
> remains at least  <XYZ-secure> ",
>
> for some value of <XYZ-secure>.
>
> As I recall, <XYZ-secure> should include things like prefix 2nd preimage
> resistance (to prevent some forgeries, and maybe to make security proofs
> work
> ....) and pseudorandom (to protect r generation).


It's true if a second preimage attack were found that collision resistance
would be violated, but that's like saying remote code execution attacks
also make you vulnerable to local file disclosure attack. But RCE is a
distinct and much more severe attack, and if someone said they offered a
"local file disclosure" defense, personally I would not expect that
guarantee to hold in the event of RCE.

By analogy, that's how I feel about the text regarding collisions here:
you're saying the text is untrue in the presence of an adversary who has
capabilities beyond what it sates, because the attacker could de-escalate
to the less powerful attack if they so desired. That seems to be colluding
the less powerful attack with the more powerful one, which I find confusing.

The text makes sense to me as-is.

-- 
Tony Arcieri