Re: [Cfrg] Message Digest Algorithm Choice for CMS with Ed448

[Taylor R Campbell <[e-mail]>]

   Date: Mon, 14 Nov 2016 11:28:56 -0500
   From: Derek Atkins <[e-mail]>

   It depends which security service of signatures you're asking about.
   For non-repudiation, yes, collision resistance is important.  However
   preimage resistance is important for integrity/forging security.

No!

A signature scheme defined in terms of H(m), such as RSASSA-PSS,
relies on the collision resistance of H to prevent forgery.  Preimage
resistance is *not* sufficient.  Failure of MD5 to be collision-
resistant is what enabled HTTPS certificate forgery in the wild ten
years ago.

(Attack: Find m =/= m' such that H(m) = H(m') and m is a certificate
for for harmlessexample.com while m' is a certificate for google.com.
Submit a CSR to a CA that you predict will issue m signed.  Now you
have a signed certificate for google.com.)

A more sensible signature scheme defined in terms of H(r, m) for some
unpredictable per-message value r, such as EdDSA, relies only on the
*target* collision resistance of H to prevent forgery.  This is a
stronger requirement than preimage resistance, but all the standard
hash functions, even MD5, are still conjectured to be target-
collision-resistant.

However, the question at hand is about a scheme defined in terms of
H(m) -- in particular, what H should we use for computing the message
digest in step 1 of Russ Housley's original message, message-id
<[e-mail]> at
<https://www.ietf.org/mail-archive/web/cfrg/current/msg08786.html>?

   Date: Sat, 12 Nov 2016 22:55:21 -0500
   From: Russ Housley <[e-mail]>

   The CURDLE WG is working on a document that specifies the
   conventions for using EdDSA with CMS [RFC5652].  See
   draft-ietf-curdle-cms-eddsa-signatures.

   The most common case involves these steps:

      1.  Compute a message digest on the content.
      [...]

Can we persuade the CURDLE WG to use an H(r, m) scheme instead, such
as EdDSA without the prehash, and thereby dispel requirements of
collision resistance?