[Cfrg] Thoughts on a Next-Generation Elliptic Curve Signature Scheme?

[Alyssa Rowan <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

At some point, clearly we're going to need a signature scheme for
these "Chicago curves" specified in SafeCurves, for later use to
replace ECDSA with something which is a more convenient fit for them
and doesn't want random numbers for each signature, for future use in
certificates, authentication, and the like.

I feel like now would be a good point, hence this request for ideas.

On 11/01/2014 17:40, Robert Ransom wrote:
> Dr. Bernstein's EdDSA is even worse: it prohibits every curve that
>  Dr. Bernstein himself has specified since Curve25519.

EdDSA seem like a pretty good start for a new signature scheme to me,
even if as it stands I think it's closely tied to Ed25519 itself
(basically, due to the size and construction?).

Schnorr-type signatures using an Edwards representation would be the
obvious natural candidate.

Either the Edwards curves or the Edwards isomorphism of one of the
Montgomery curves would do, although the ones specified as Edwards
curves would likely be cleaner, particularly Curve1174, Curve3617 and
E521: in fact, those would be the three I'd plump for, as I think they
provide three pretty good security/efficiency points.

We're going to need a hash, too. I suggest that we should use one of
the new hash algorithms that came out of the SHA-3 competition. All
the finalists have something to recommend them (I really like Skein
and BLAKE myself): but the least controversial in my eyes, and so the
one I'd on consideration suggest, is Keccak, given it was the winner
and thus has the additional backing of being SHA-3. (I can see ways
its particular attributes might prove helpful, too.)

Do you have any thoughts?

- -- 
/akr
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJS0Y8GAAoJEOyEjtkWi2t672AP/im0Ztbd7Y3Atl4OwXvutzJ9
X0eSWp2INfPaQ8XxddIM3Q0P1TbrUhIP8vbV15mGv9vjF2ZtmOmtimnF5crcha2A
Ss+sBiW/jUE/K8/y9y9hhyEKdJgZ+AQO0Zx6GL4nwu83Pn+sPs3LuAkpMWz7cItC
bmgxR9bU9N//xPa0KidFHmRgMCaR5QF49Cdmyf8m+U+W7Mpp3pLu9VOAYj8AA5Q0
lKPDTkp+QceRcBA6Mp5hMg5WZbz/uhqj52AFzbsM8rmvVTIPSQCy4v7qmS4zTHVa
G7VwgfauWSZ3PeAwRk1sfN4xRzzaBqQmhMps+sCZ6+JK2RAaZ0BVHIAaeAP8RBLr
ZMSglLd387yfRnMyMeg1PsNaWM0Y/SqQ3SKWSpqSiAut8Z/GoZ6V6FcmYDmyxrtE
Y/1HU2R8Ea6cUtdcwf05kHUpf78GMEQqAxG0+jaaBivEBR+B5RWHIwUfnL4+GdEj
kOx3o3gGEavGAHUGqvVZI4RoJYAVleAQFqnujldKI+8WhbtD1M4GxuIJSr9f4EA6
gKReED3mEXTzjmWEcdl5CyjF3hggwxdpEKSOjH0LSdZmHfatnSnjEHQY57LDSCWC
H+pfN9wb993VlCNK6vz9Rjn0K/oAkyYWZDRgvcE2eX0DAMgSXuPGshydp4kLZVCw
4xYIvNRTUS5Sv+s0iL7Y
=bB3k
-----END PGP SIGNATURE-----