Re: [Cfrg] Summary of the poll: Elliptic Curves - signature scheme: friendliness to low memory implementations (ends on June 3rd)

[Taylor R Campbell <[e-mail]>]

   Date: Sat, 20 Jun 2015 00:02:25 +0100
   From: Alyssa Rowan <[e-mail]>

   I was simply pointing out that OpenSSH have deployed EdDSA(m) with
   absolutely no troubles, and so have GnuPG, which have large messages.
   It worked for them, so I don't think it's a huge concern in practice?

For the record: GnuPG deployed EdDSA(H(m)), not EdDSA(m), because
every signature in OpenPGP takes the form Sign(H(m)) for some hash
function H which may vary from message to message according to user
preferences.

(This is not to say that OpenPGP's approach is a good idea.  Not much
has changed in it in the two decades since it was first designed, in
spite of two decades of advances in cryptography engineering.  Should
the CFRG recommend that new protocols ignore decades of advances and
experience from practical attacks in the wild, in favour of remaining
stuck in the cryptography engineering practices of 1995?)