Re: [Cfrg] On the differences of Ed25519/448 and how it affects a vote on twoshakes-d

[Simon Josefsson <[e-mail]>]

Brian Smith <[e-mail]> writes:

> Simon Josefsson <[e-mail]> wrote:
>
>> This is incorrect -- Ed25519 and Ed25519ph are domain separated since
>> they are different algorithms.  You should never use the same key with
>> both algorithms, just as you shouldn't use the wrong
>> domain-separation-bits in Ed448 twoshakes-d with the same key.
>>
>
> You could say something similar about RSA w.r.t. RSA encryption vs RSA
> PKCS#1 vs RSA PSS. However, in practice, people are and will use the same
> RSA key for multiple algorithms unless there's something that makes it
> difficult to do so. I suspect the same will happen with Ed25519 and
> Ed25519ph. Consequently, I don't think we should consider Ed25519 and
> Ed25519ph to be domain-separated in practice.

For RSA I believe this happened because the specifications 1) didn't
talk about this problem, and 2) was written to allow this to happen
(i.e., a PKCS#1 key and a PSS key are encoded the same way).  I don't
see this happening for Ed25519, or do you have counter-examples?

/Simon