Re: [Cfrg] draft-irtf-cfrg-eddsa -- one final proposal for domain separation (context labels) for ed25519

[Ilari Liusvaara <[e-mail]>]

On Wed, Apr 20, 2016 at 11:57:36AM -0400, Daniel Kahn Gillmor wrote:
> On Wed 2016-04-20 10:29:53 -0400, Ilari Liusvaara wrote:
> > On Wed, Apr 20, 2016 at 08:51:22AM -0400, Daniel Kahn Gillmor wrote:
> 
> >> the "empty string" message in my message was not part of the proposed
> >> wording change to the draft, but i can see how it might be confusing if
> >> it were to make it into an edit.
> >> 
> >> If we need additional clarification in the draft to avoid confusion, i
> >> propose:
> >> 
> >>   If no context label is supplied, it is treated as an octet string of
> >>   zero length; that is, (context || x) is the same as x.
> >
> > Also, anyone up to some quick analysis to show that doesn't interact
> > harmfully with Ed25519 when using the same keys?
> 
> eh?  this is specifically and only about how to apply a context label in
> Ed25519 and Ed25519ph, since it's already defined for Ed448 -- what do
> you mean "interact harmfully with Ed25519" ?

Suppose attacker can get signatures for arbitrary (context,message) pairs
under some key, can he forge a signature for some (context',message') under
that key that he didn't see?

> > Also, that wouldn't solve the troublesome interaction between Ed25519
> > and Ed25519ph...
> 
> That's true, this proposal doesn't try to solve that problem.  I hope it
> can be evaluated independently.

I actually once implemented variant of Ed25519 with contexts done like
Ed448. Separate variant, so needed its own keys. It would be very easy
to build Ed25519ph-like scheme by just using SHA-512(msg) as prehash
and marking the message as prehashed (there is no need for context in
inner hash).


-Ilari