Re: [Cfrg] Summary of the poll: Elliptic Curves - signature scheme: friendliness to low memory implementations (ends on June 3rd)

["Blumenthal, Uri - 0553 - MITLL" <[e-mail]>]

On 6/19/15, 17:32 , "Adam Langley" <[e-mail]> wrote:

>Ponder, for a second, a world in which CFRG specified two schemes:
>Ed25519(m) and Ed25519(H(m))…...
>
>I, the attacker, can register a domain name and get a certificate for
>it. The CA happens to sign with Ed25519(H(m)), even though the
>messages aren't very large. So, offline, I iterate over many domain
>names and pick one where the hash of the certificate structure for
>that name and my public-key looks like a valid CRL message. I need to
>fix the first byte to be one, probably fix a few other length bytes,
>and obviously my fake CRL has to be exactly the length of a hash, but
>the work-factor is pretty plausible.

Good point. But doesn’t that imply the ability to create collisions in H()
at will?

>So we would need to be careful with Ed25519(H(m)).

Sure… On the other hand, I’d like a demonstration, if possible. One
example of the above would suffice. :-)

P.S. I assume H() is a decent hash, e.g. SHA-3 or BLAKE2.