Re: [Cfrg] Poll: hash functions for Ed448 (ends on December 22nd)

As correctly pointed out to me by Tony Arcieri, I have swapped the comments between 4 and 5.

Luckily I both voted them -1.

Best Regards,
Ruggero

-----Original Message-----
From: ruggero.susella@st.com 
Sent: Tuesday, December 22, 2015 11:18 AM
To: cfrg@irtf.org
Subject: RE: [Cfrg] Poll: hash functions for Ed448 (ends on December 22nd)

1) twoshakes-s:  0. Simplest method, but I'd prefer to have domain separation.
2) twoshakes-d: +1. My preference.
3) simon1: 0. I can understand the use of SHA3-512 for prehash, although it's slower.
4) simon2:  -1. No mixing SHA-2 and SHA-3.
5) ilari1:  -1. I don't like SHA2-512/xxx where xxx > 512. SHAKE has a much more natural way to do the same. 
6) ilari2:  -1. I'm a bit conflicted on this. I don't like HKDF and HMAC, but HKDF is used and can do the job. I'm going for -1 instead of 0 due to efficiency of HKDF compared to SHAKE.

Best Regards,
Ruggero

-----Original Message-----
From: Cfrg [mailto:cfrg-bounces@irtf.org] On Behalf Of Alexey Melnikov
Sent: Tuesday, December 08, 2015 4:31 PM
To: cfrg@irtf.org
Subject: [Cfrg] Poll: hash functions for Ed448 (ends on December 22nd)

This message starts 2 weeks Quaker Poll on hash functions to be used for 
definition of Ed448 in draft-irtf-cfrg-eddsa. Please reply for each choice:
+1, if you prefer a particular choice
0, if you can live with it
-1, if you are against a particular choice

Choices are:

1) "twoshakes-s", (SHAKE256@912(x) for the internal hash, 
SHAKE256@512(x) as the prehash)

More details: 
<http://www.ietf.org/mail-archive/web/cfrg/current/msg07629.html>

2) "twoshakes-d",

This scheme again uses the SHAKE256 extensible-output functions (XOFs) 
to implement both hashes, with the inputs prefixed as specified below 
for explicit domain separation purposes.

More details: 
<http://www.ietf.org/mail-archive/web/cfrg/current/msg07629.html>

3) "simon1" (SHAKE256@912(x) for the internal hash, SHA3-512 as the 
prehash).

4) "simon2" (Use SHA2-512/912 as described in [1] as the internal hash 
and SHA2-512 as the prehash).

[1] - <http://ed25519.cr.yp.to/eddsa-20150704.pdf>

5) "ilari1" (SHAKE256@912bits(x) for the internal hash, SHA2-512(x) as 
the prehash)

More details: 
<http://www.ietf.org/mail-archive/web/cfrg/current/msg07644.html>

6) "ilari2"

Hash: HKDF-EXPAND(hash=SHA2-512, prk=HKDF-EXTRACT(hash=SHA2-512, 
salt=<blank>, ikm=x), info=<blank>, 114) Prehash: SHA2-512(x)

More details: 
<http://www.ietf.org/mail-archive/web/cfrg/current/msg07644.html>

7) You can specify an alternative proposal, if you wish

Best Regards,
Kenny and Alexey

_______________________________________________
Cfrg mailing list
Cfrg@irtf.org
https://www.irtf.org/mailman/listinfo/cfrg