Re: [Cfrg] EC signature: next steps

[Ilari Liusvaara <[e-mail]>]

On Mon, Aug 31, 2015 at 03:06:43PM +0200, Simon Josefsson wrote:
> Alexey Melnikov <[e-mail]> writes:
> 
> > - are there errors of fact or omission that need to be corrected?
> 
> 1) I don't understand by this part of Ilari's writeup: 'dictated by
> ???'.

I earlier tought that the prehash comes from the key, but then
read comment by DJB stating that this is not the case.
 
> 2) I disagree with 'Neither personalization nor firewalling is
> supported.'.  As far as I understand what Ilari intend, both are
> supported in the sense that they can be added by a higher-level
> abstraction, which I believe is a more appropriate approach than jamming
> this into the signature primitive.

I fully agree that putting firewalling into higher layers is better
idea than putting it into signature primitive. However, apparently
the signature primitive is to support signature-level online operation
(which I think is rather bad idea) as opposed to protocol-level online
operation.

As for personalization, the problem is that protocols A and B (or
even just different versions of the same protocol!) can interpret the
same message in rather different ways.

(Personalization does create some issues with application interface).


> 3) What is NPOT?

(Order) Near Power Of Two. The difference of order and nearest power
of two is on order of sqrt(l).

Such orders produce even distributions of x mod l, where x is n bits
long with smaller n than usual.

Both Curve25519 and Curve448 are NPOT. 



-Ilari