IETF Logo Mail Archive

Re: [Cfrg] draft-irtf-cfrg-eddsa -- one final proposal for domain separation (context labels) for ed25519

Ilari Liusvaara <ilariliusvaara@welho.com> Fri, 22 April 2016 09:16 UTC

Return-Path: <ilariliusvaara@welho.com>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E783C12EAC9; Fri, 22 Apr 2016 02:16:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.896
X-Spam-Level:
X-Spam-Status: No, score=-2.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.996] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7x3jHJOwWSAt; Fri, 22 Apr 2016 02:16:24 -0700 (PDT)
Received: from welho-filter4.welho.com (welho-filter4.welho.com [83.102.41.26]) by ietfa.amsl.com (Postfix) with ESMTP id DB45712EAC7; Fri, 22 Apr 2016 02:16:23 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by welho-filter4.welho.com (Postfix) with ESMTP id A6CB24C0F; Fri, 22 Apr 2016 12:16:22 +0300 (EEST)
X-Virus-Scanned: Debian amavisd-new at pp.htv.fi
Received: from welho-smtp1.welho.com ([IPv6:::ffff:83.102.41.84]) by localhost (welho-filter4.welho.com [::ffff:83.102.41.26]) (amavisd-new, port 10024) with ESMTP id 441AWzKiU2-a; Fri, 22 Apr 2016 12:16:21 +0300 (EEST)
Received: from LK-Perkele-V2 (87-100-143-35.bb.dnainternet.fi [87.100.143.35]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp1.welho.com (Postfix) with ESMTPSA id D7D9A27F; Fri, 22 Apr 2016 12:16:21 +0300 (EEST)
Date: Fri, 22 Apr 2016 12:16:18 +0300
From: Ilari Liusvaara <ilariliusvaara@welho.com>
To: "draft-irtf-cfrg-eddsa.all@ietf.org" <draft-irtf-cfrg-eddsa.all@ietf.org>, "cfrg@ietf.org" <cfrg@ietf.org>
Message-ID: <20160422091618.GB27448@LK-Perkele-V2.elisa-laajakaista.fi>
References: <20160420142953.GA23528@LK-Perkele-V2.elisa-laajakaista.fi> <87potk1de7.fsf@alice.fifthhorseman.net> <20160420182617.GA23652@LK-Perkele-V2.elisa-laajakaista.fi> <87bn540xh3.fsf@alice.fifthhorseman.net> <20160421043947.GA24394@LK-Perkele-V2.elisa-laajakaista.fi> <alpine.GSO.1.10.1604211349530.26829@multics.mit.edu> <20160421195014.GA26169@LK-Perkele-V2.elisa-laajakaista.fi> <87zismzo9o.fsf@alice.fifthhorseman.net> <20160422062121.GA27448@LK-Perkele-V2.elisa-laajakaista.fi> <CABkgnnVd28WHT+wpMxVd+XczkiJmExkjTewG5B_a1uKgTMo7+A@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Disposition: inline
In-Reply-To: <CABkgnnVd28WHT+wpMxVd+XczkiJmExkjTewG5B_a1uKgTMo7+A@mail.gmail.com>
User-Agent: Mutt/1.5.24 (2015-08-30)
Sender: ilariliusvaara@welho.com
Archived-At: <http://mailarchive.ietf.org/arch/msg/cfrg/P9kFsrbLLnvElJdrlCQVqDrDzoE>
Subject: Re: [Cfrg] draft-irtf-cfrg-eddsa -- one final proposal for domain separation (context labels) for ed25519
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Fri, 22 Apr 2016 09:16:26 -0000

On Fri, Apr 22, 2016 at 05:26:37PM +1000, Martin Thomson wrote:
> On 22 April 2016 at 16:21, Ilari Liusvaara <ilariliusvaara@welho.com> wrote:
> > H(x)=SHA512(context|x) does not cause behaviour like Ed25519(key,context|x)
> > when applied.It causes behaviour that can't be expressed using the base
> > Ed25519 primitive.
> 
> I don't know why we got hung up on that concept.  PH(x) =
> SHA512(context || x) might be closer to what we've been thinking of.

1) That only 'works' with Ed25519ph. And even with that, you do not
want the context inside data hash.

2) You definitely do not want that kind of context schemes on non-
context keys. Even the prepending the context in hash (without
separation) makes me VERY uneasy.


-Ilari

v2.23.0 | Report a Bug | By Email