Re: [Cfrg] draft-irtf-cfrg-eddsa -- one final proposal for domain separation (context labels) for ed25519

[Ilari Liusvaara <[e-mail]>]

On Thu, Apr 21, 2016 at 04:43:15PM -0400, Daniel Kahn Gillmor wrote:
> On Thu 2016-04-21 15:50:14 -0400, Ilari Liusvaara wrote:
> > I actually implemented the scheme (modifying the python reference
> > implementation in the draft (modifying H(x) to be SHA512(context|x)).
> >
> > - Modified and base scheme generate identical signatures and validate
> >   identical signatures for empty context (as expected).
> > - Signature of ('abc','def') is different from signature of ('abcd','ef')
> >   and does not cross-validate. Nor does either cross-validate with
> >   ('',abcdef).
> 
> Is this because you're including the NUL octet between the context and
> the signature, or for some other reason?  if so, then i'd phrase it as:
> 
>  signature of ('abc\0', 'def') is different from signature of ('abcd\0', 'ef')
> 
> which i think everyone would agree is the right outcome.
> 
> Or are you talking about some other scheme?

No, I am not including '\0'.

I literially modified H(x) to prepend context (defaulted to blank byte
string), with no lengths nor separators to x before hashing with SHA-512..

It does not handle empty context as special case, since <empty> is
additive identity for string concatenation.

> > [ben kaduk wrote:]
> >> From where I am sitting, it seems like there are two options: does
> >> the signing API include a context input?  If yes, use that input; if
> >> no, prepend the context to the message to be signed in my own code.
> >> What am I missing?
> >
> > This does not work.
> 
> Why not?  Can you explain more?

H(x)=SHA512(context|x) does not cause behaviour like Ed25519(key,context|x)
when applied.It causes behaviour that can't be expressed using the base
Ed25519 primitive.



-Ilari