Re: [Cfrg] Help with the use of contexts

["Paterson, Kenny" <[e-mail]>]

Dear CFRG,

Please chime in asap if you have a view on the issue of signature contexts
in TLS 1.3, as described by Sean below. Otherwise, chairs will make a
possibly ill-informed decision...

Regards

Kenny

On 04/01/2017 21:55, "Cfrg on behalf of Sean Turner"
<[e-mail] on behalf of [e-mail]> wrote:

>Hi CFRG,
>
>The TLS WG is nearing the end of our journey moving EC-based algorithms
>for TLS 1.2 (and earlier) from Informational to Standards track [0].
>While we were doing that we also added in 25519 and x448 as well as EdDSA.
>
>I’d like to get some input from the CFRG on the use of contexts; the
>"context label" is a way to provide domain separation between signatures
>made in different contexts, avoiding cross-protocol attacks.  s10.3 of
>draft-irtf-cfrg-eddsa includes the following:
>
>Contexts SHOULD NOT be used opportunistically, as that kind of use
>is very error-prone.  If contexts are used, one SHOULD require all
>signature schemes available for use in that purpose support
>contexts.
>
>This is great advice for new protocols because it’s easy to make all the
>schemes the same, but for existing protocols like TLS where there’s zero
>chance of obsoleting the existing signature schemes and defining new
>signature schemes with contexts it makes you wonder what
>“opportunistically” means. I.e., would setting a context parameter for
>Ed448 and no other already defined signature scheme be considered
>opportunistic?
>
>spt
>(as document Shepherd for draft-ietf-tls-rfc4492bis)
>
>[0] https://datatracker.ietf.org/doc/draft-ietf-tls-rfc4492bis/
>_______________________________________________
>Cfrg mailing list
>[e-mail]
>https://www.irtf.org/mailman/listinfo/cfrg