Re: [Cfrg] Elliptic Curves - signature scheme: friendliness to low memory implementations (ends on June 3rd)

[Simon Josefsson <[e-mail]>]

Andrey Jivsov <[e-mail]> writes:

> On 5/29/2015 12:49 PM, Simon Josefsson wrote:
>> Andrey Jivsov <[e-mail]> writes:
>>
>>> Major OpenPGP implementations use streaming mode to sign (e.g. in 'cat
>>> InFile | gpg --clearsign'), just as with encryption, without writing
>>> sensitive data to a temporary file. They depend on IUF. I haven't seen
>>> this with SMIME/CMS -- this is harder, but possible.
>> It is no problem to support streaming of inputs and at the same time
>> support for example EdDSA which does not follow the IUF paradigm.  Don't
>> confuse Unix stdin/stdout streaming with streaming of input to a digital
>> signature algorithm.
>
> Yes, but what cost "no problems" actually has in some cases?
>
> Before: one could hash during streaming.
> After: one extra re-hashing is needed, denying the benefit of hashing
> while streaming.

I believe you are mistaken.  OpenPGP with EdDSA only hashes once, during
streaming.

> To fix this new demand of low-level crypto there needs to be an
> engineering fix at a higher level. In the case of OpenPGP applications
> this means the buffering of the entire input must happen, somehow.

This is false, there is no need to buffer the entire message.  Just hash
the stream and sign the hash.

> If a user signs+encrypts a 1 TB file, he needs to have at least 2TB of
> disk space, one at the destination, and another at an
> implementation-specific location (e.g. /tmp directory, at destination,
> or $HOME). Besides user unfriendliness, such as slower performance and
> extra free space demands, one cannot really delete/wipe a sensitive
> file on an SSD drive, and the temporary file allows good possibility
> for signature fault attacks.

I believe GnuPG already implements EdDSA signing, so you can look at the
implementation to see how it actually works.  There is no temporary
files the same size as the input.

/Simon