Re: [CFRG] guidance on using an Ed25519 keypair for x25519

Good to know.

I was worrying that I would have to register a encrypt only keypair via 
the sign only keypair.  Really complicates the registration process.

Plus the risk that implementors would get it wrong.

On 6/21/22 03:54, Göran Selander wrote:
>  >> Specifically, in Section 2.4: Pairwise Keys. >> >> 
https://datatracker.ietf.org/doc/html/draft-ietf-core-oscore-groupcomm#section-2.4 
 >> 
<https://datatracker.ietf.org/doc/html/draft-ietf-core-oscore-groupcomm#section-2.4> 
 > > >> Adding some more background. There are two modes of use of the 
asymmetric keys in [1]: “group mode” (message signed by the sender) and 
“pairwise mode” (message encrypted for the receiver). Communication 
between group members may use only a single mode (any to all vs. any to 
any) or a mix of the modes, and the latter is useful for reducing 
communication overhead:
>  > > > * In [2], which uses multicast request withoptional unicast > 
responses, the request can be protected with group mode and the > 
responseswith pairwise mode, i.e. a MAC instead of a signature, per > 
response. * Conversely, in [3] multiple clients subscribe to a > 
particular resource using unicast (protected with pairwise mode) and > 
receive anotification assinglemulticast (protected with group > 
mode)instead of individual notifications. > > > > Each group member 
could have their own double key pairs, one for each > mode, but a single 
key pair reduces overhead for distribution and > storage. The security 
of using the same key pair in case of ECDSA was > already known [4] and 
Ben Kaduk lifted the issue that the result was > not known for EdDSA 
triggering Erik to prove it. > > > > Göran > > > > > > [1] > 
https://datatracker.ietf.org/doc/draft-ietf-core-oscore-groupcomm/ > > 
[2] https://datatracker.ietf.org/doc/draft-ietf-core-groupcomm-bis/ > > 
[3] > 
https://datatracker.ietf.org/doc/draft-ietf-core-observe-multicast-notifications/ 
 > > > [4] https://degabriele.info/publications/EMV_Joint_Sec.pdf
>  > > > *From: *CFRG <cfrg-bounces@irtf.org> on behalf of Manu Sporny > 
<msporny@digitalbazaar.com> *Date: *Tuesday, 21 June 2022 at 01:46 > 
*To: *cfrg@irtf.org <cfrg@irtf.org> *Subject: *Re: [CFRG] guidance on > 
using an Ed25519 keypair for x25519 > > On 6/20/22 6:44 PM, Robert 
Moskowitz wrote: >> This seems to pop up in places, and I found: >> >> 
https://eprint.iacr.org/2021/509 >> <https://eprint.iacr.org/2021/509> 
 >> >> Is this covered in any IETF RFC? I am coming up empty; my search 
 >> foo is weak.... > > We point to that document in the 'did:key' 
Decentralized Identifier > Method specification: > > 
https://protect2.fireeye.com/v1/url?k=31323334-501cfaf3-313273af-454445554331-218b00b6f213fa10&q=1&e=df349bd1-f6ee-4096-964d-6105d7db190d&u=https%3A%2F%2Fw3c-ccg.github.io%2Fdid-method-key%2F%23derive-encryption-key-algorithm 
 > 
<https://protect2.fireeye.com/v1/url?k=31323334-501cfaf3-313273af-454445554331-218b00b6f213fa10&q=1&e=df349bd1-f6ee-4096-964d-6105d7db190d&u=https%3A%2F%2Fw3c-ccg.github.io%2Fdid-method-key%2F%23derive-encryption-key-algorithm> 
 > > > At least one place it's being used, AFAICT, is the OSCORE work:
>  > 
https://datatracker.ietf.org/doc/html/draft-ietf-core-oscore-groupcomm > 
<https://datatracker.ietf.org/doc/html/draft-ietf-core-oscore-groupcomm> 
 > > > Specifically, in Section 2.4: Pairwise Keys.
>  > 
https://datatracker.ietf.org/doc/html/draft-ietf-core-oscore-groupcomm#section-2.4 
 > 
<https://datatracker.ietf.org/doc/html/draft-ietf-core-oscore-groupcomm#section-2.4> 
 > > > You can find references to that document throughout the OSCORE 
specification.
>  > Hope that helps. > > On a related note, we've been told by security 
researchers that NIST > is unlikely to view such an operation as safe to 
use with US > government systems, even if the Thormarker proof is found 
to be > valid, given the general policy against key reuse at NIST. Has 
anyone > else on here heard the same sort of thing from NIST? > > -- 
manu > > -- Manu Sporny - > 
https://protect2.fireeye.com/v1/url?k=31323334-501cfaf3-313273af-454445554331-fb3168714b4aa4b6&q=1&e=df349bd1-f6ee-4096-964d-6105d7db190d&u=https%3A%2F%2Fwww.linkedin.com%2Fin%2Fmanusporny%2F 
 > 
<https://protect2.fireeye.com/v1/url?k=31323334-501cfaf3-313273af-454445554331-fb3168714b4aa4b6&q=1&e=df349bd1-f6ee-4096-964d-6105d7db190d&u=https%3A%2F%2Fwww.linkedin.com%2Fin%2Fmanusporny%2F> 
 > > Founder/CEO - Digital Bazaar, Inc.
> News: Digital Bazaar Announces New Case Studies (2021)  > 
https://protect2.fireeye.com/v1/url?k=31323334-501cfaf3-313273af-454445554331-144df54e6622daf1&q=1&e=df349bd1-f6ee-4096-964d-6105d7db190d&u=https%3A%2F%2Fwww.digitalbazaar.com%2F 
 > 
<https://protect2.fireeye.com/v1/url?k=31323334-501cfaf3-313273af-454445554331-144df54e6622daf1&q=1&e=df349bd1-f6ee-4096-964d-6105d7db190d&u=https%3A%2F%2Fwww.digitalbazaar.com%2F> 
 > > > _______________________________________________
> CFRG mailing list CFRG@irtf.org > 
https://protect2.fireeye.com/v1/url?k=31323334-501cfaf3-313273af-454445554331-9034b67a44f3143f&q=1&e=df349bd1-f6ee-4096-964d-6105d7db190d&u=https%3A%2F%2Fwww.irtf.org%2Fmailman%2Flistinfo%2Fcfrg 
 > 
<https://protect2.fireeye.com/v1/url?k=31323334-501cfaf3-313273af-454445554331-9034b67a44f3143f&q=1&e=df349bd1-f6ee-4096-964d-6105d7db190d&u=https%3A%2F%2Fwww.irtf.org%2Fmailman%2Flistinfo%2Fcfrg> 
 > > > > _______________________________________________
> CFRG mailing list CFRG@irtf.org > https://www.irtf.org/mailman/listinfo/cfrg