Re: [Cfrg] draft-irtf-cfrg-eddsa -- one final proposal for domain separation (context labels) for ed25519

[Ilari Liusvaara <[e-mail]>]

On Fri, May 06, 2016 at 09:03:47AM +0200, Simon Josefsson wrote:
> Daniel Kahn Gillmor <[e-mail]> writes:
> 
> > A recent example is
> > https://tools.ietf.org/html/draft-ietf-curdle-dnskey-eddsa-00, which
> > defines DNSKEY records for both Ed25519 and Ed448.  I spoke to the
> > authors about using a context label to avoid RRSIGs from being re-usable
> > in non-RRSIG contexts.
> 
> Instead of introducing complexity (i.e., contexts), I suggest that you
> recommend to not re-use the same key for different purposes!
> 
> Key re-use for different purposes is the fundamental problem as I see
> it.  The idea behind context may have good intentions, but I believe
> contexts is only a band-aid for the problem of cross-domain key-reuse,
> and I believe that overall contexts introduce more harm than they
> address.  I believe it is better to address the problem at its source.

Actually, the problem is that context have serious fundamential usabilty
problems.

If you have self-inconsistent protocol, nothing will save you. However,
contexts suffer from serious usability problems (API and signature
layering), making them effectively unusable, even with protocols that
are self-consistent.

So yeah, just use separate keys. Don't cause problems for everybody
by using contexts.



-Ilari