Re: [Cfrg] Summary of the poll: Elliptic Curves - signature scheme: friendliness to low memory implementations (ends on June 3rd)

[Alyssa Rowan <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 2015-06-19 07:27, D. J. Bernstein wrote:

> I understand that the chairs are saying that the following
> position has rough consensus:

I've largely stayed out of this poll as I don't have an incredibly
strong opinion here, but I'd also like clarity.

EdDSA(H(m)) is weaker than EdDSA(m). Of course we desire
collision-resistance in any hash that we choose, but EdDSA(m) doesn't
NEED it.

If we propose a change to Ed25519 that makes it weaker, we'll need to
be very, very careful to justify why: otherwise our recommendations to
the upstream working group may well not be useful in contrast to
existing rough consensus and running code in, e.g., GnuPG and OpenSSH.
If we don't have a strong opinion, is it really worth the change?

TLS WG don't seem to have any concerns about Ed25519 implementation:
they're in fact talking about which OIDs to allocate. They are the
ones who will implement it in a way which most interacts with
init-update-final APIs: if they don't care to change it, need we?

- -- 
/akr
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJVhFioAAoJEOyEjtkWi2t6+X0P/jOrbfCiWxs7JrNgVGNKKY3W
1UVCDAKhM7IzL6235CqcqRIpV0CwyFWr5GkG9BE0ohqzUd280HVeLZsEGyoob7Dm
QNJ38zHuza2R4vwZHQd1G45wsdykG0NemEvF3OQSfsvjVkjj0MermxYv2n7cHGyZ
h/rUGgU7KeXhEMqrG1pJpE7HMrujGzotbqfkWDIly5bE1jR1cl+SvecaB2e0R7lI
a2ljF/Ot3/gIuljb+xeOUhTH4U2GEiW43CA/b1fLnvqwRTVa9NE0uB+A2tig0Cfe
NMBvrGstZy3tZm9p/9kI1r5OjzkrZ/ApTfMdXzRXjLS2dfn/c3BwcOvLnCoDUA2k
lXn/q5cV4tFJaBBFVom9J/+w0E6otrIcqHBeqJk9yrIX4HRSKkoN/TquOHz9Ml9w
1borWHkGcFOlGQt1POH7/7HfFH0qPcIwvVLhGs3PEles4N+EYnP1AmVKoYbJHXat
JnyV5SmJLzThNKem8BLN/QITfmHkoB/eYF+jh6yHxkvpxPNlX1RZGWfAvWa5M/hx
94rZJB7JClizwzb+mWK2X8ZGcGEtlu7n0pW/KII+N5kw2s7xW1Uu1y65l0ZEEZYV
kp2h9GkDuLg3T2BizHVWiZ5fxDNnq75GkNdzuJGKuN3LtTgUNHyto4zufTS5MD5v
XNADN5q70VIWEROeTJtF
=z1jx
-----END PGP SIGNATURE-----