Re: [CFRG] guidance on using an Ed25519 keypair for x25519

[Robert Moskowitz <[e-mail]>]

This is for my DRIP work.

The basis is Ed25519 signing:

https://datatracker.ietf.org/doc/draft-ietf-drip-rid/
https://datatracker.ietf.org/doc/draft-ietf-drip-auth/

But now the next step gets into secure communications.

https://datatracker.ietf.org/doc/draft-moskowitz-drip-secure-nrid-c2/

Use 'standard' secure comm: DTLS, IPsec, and HIP, so Ed25519 works but 
DTLS and IKE need a boost to get the full Identity in the setup.

However

https://datatracker.ietf.org/doc/draft-moskowitz-drip-operator-privacy/
https://datatracker.ietf.org/doc/draft-moskowitz-drip-crowd-sourced-rid/

Get into using ECIES.  A bit different domain of traffic, but it is 
advantageous to use the same keypair as the base identity.

Also the ECIES is static-static so that adds to the challenge, needing a 
nonce at least.

Bob

On 6/20/22 19:44, Manu Sporny wrote:
> On 6/20/22 6:44 PM, Robert Moskowitz wrote:
>> This seems to pop up in places, and I found:
>>
>> https://eprint.iacr.org/2021/509
>>
>> Is this covered in any IETF RFC?  I am coming up empty; my search foo is
>> weak....
> We point to that document in the 'did:key' Decentralized Identifier Method
> specification:
>
> https://w3c-ccg.github.io/did-method-key/#derive-encryption-key-algorithm
>
> At least one place it's being used, AFAICT, is the OSCORE work:
>
> https://datatracker.ietf.org/doc/html/draft-ietf-core-oscore-groupcomm
>
> Specifically, in Section 2.4: Pairwise Keys.
>
> https://datatracker.ietf.org/doc/html/draft-ietf-core-oscore-groupcomm#section-2.4
>
> You can find references to that document throughout the OSCORE specification.
>
> Hope that helps.
>
> On a related note, we've been told by security researchers that NIST is
> unlikely to view such an operation as safe to use with US government systems,
> even if the Thormarker proof is found to be valid, given the general policy
> against key reuse at NIST. Has anyone else on here heard the same sort of
> thing from NIST?
>
> -- manu
>