Re: [Cfrg] EC signature: next steps

[Simon Josefsson <[e-mail]>]

Alexey Melnikov <[e-mail]> writes:

> - are there important characteristics or points of comparison that
> Ilari's summary does not cover?

1) Maturity.  Ed25519 was published through CHES in 2011 and has been
peer-reviewed since then.  I would appreciate if someone could find
dates of publications on the other proposals and find out how much of
scientific review they have seen.

2) Implementation status.  There are many Ed25519 implementations
around, many are freely available with source code under liberal
licenses.  Understanding the status of the other proposals would be
useful too.

3) Deployment.  Ed25519 is implemented and deployed by two IETF
protocols (SSH and OpenPGP), with more on their way.  There are many
libraries around for implementation, see
<http://ianix.com/pub/ed25519-deployment.html>.

> - are there errors of fact or omission that need to be corrected?

1) I don't understand by this part of Ilari's writeup: 'dictated by
???'.

2) I disagree with 'Neither personalization nor firewalling is
supported.'.  As far as I understand what Ilari intend, both are
supported in the sense that they can be added by a higher-level
abstraction, which I believe is a more appropriate approach than jamming
this into the signature primitive.

3) What is NPOT?

/Simon