Re: [Cfrg] Signature proposal

[Dan Brown <[e-mail]>]

> -----Original Message-----
> From: Michael Hamburg
> 
> I believe that this would compromise the signing key, at least if the two hashes
> are used with the same curve and the length difference is small.  However, I’m
> not aware of any two deployed hash functions where one is a truncation of
> another; in particular, SHA512/n have different IVs.  So this would only happen
> if you truncate the same hash to two difference lengths, or use a variable-
> output-length hash with two different output lengths.
> 
[DB] Thanks for checking this.

Also, I did some after-post fact-checking and found that SHA-384 and SHA-224 do indeed use different IVs than SHA-512 and SHA-256.  Sorry for forgetting that crucial fact.

Good catch about the small difference in output length. Yes, I forgot to mention that the attacker has to guess the truncated bits to find a linear relation.  So, truncation from 512 down to 256 would defeat the attack.

I've since noticed that some (old?) versions of HMAC do allow truncation. Because I've suggested trying to avoid extension attacks on prefixed-hashing with SHA-1/2 to generated ephemeral secrets, I will look further into the impact of using HMAC as a PRF for this task.  I think it's just better to go with SHA-3, but an alternative is mandate no truncation to be used in the generation of the ephemeral key.