[CFRG] 回复: I-D Action: draft-irtf-cfrg-det-sigs-with-noise-03.txt

[Niu Danny <[e-mail]>]

I don't think the name change is needed.

Think about it this way: if you change the name of the signing algorithm, then that's the verifying algorithm supposed to be called?

We can call the schemes deterministic-EdDSA and hedged-EdDSA - these qualifiers are descriptive enough already. Also for the use case, we can borrow the experience with the NIST draft for Dilithium and SPHINCS+, just set Z to all-zero when using the deterministic variant.

________________________________________
发件人: CFRG <[e-mail]> 代表 Simon Josefsson <simon=[e-mail]>
发送时间: 2024年3月22日 00:54
收件人: John Mattsson
抄送: [e-mail]
主题: Re: [CFRG] I-D Action: draft-irtf-cfrg-det-sigs-with-noise-03.txt

John Mattsson <john.mattsson=[e-mail]> writes:

> Hi,
> We have just uploaded version -03 of Hedged ECDSA and EdDSA Signatures.

This still uses the approach to modify RFC 8032 instead of introducing
new primitives with new separate names.  I believe this will cause
confusion: will an implementation of 'Ed25519' behave per RFC 8032 or
your document?  It seems clear that the suggested changes here are not
applicable to all use-cases, and the changes may be undesirable to many
use-cases.

How about modifying your document to introduce new primitives HEd25519,
HEd25519ph, HEd25519ctx in parallel to existing primitives Ed25519,
Ed25519ph, Ed25519ctx?  Same for 448.

I suggested using names REd* for this earlier, so essentially this is
the same request but use the new term 'Hedged' instead of 'Randomized'.
I feel the term 'Hedged' is not the best term, as it conveys the notion
of a value judgement, but using any distinct name is better than
re-using the same name to mean two different things.

Btw, maybe this could go into a RFC 8032bis instead, fixing other
erratas on the way.

/Simon