Re: [Cfrg] On the differences of Ed25519/448 and how it affects a vote on twoshakes-d

[Ilari Liusvaara <[e-mail]>]

On Fri, Dec 11, 2015 at 04:26:00PM +0100, Gilles Van Assche wrote:
> 
> With the point of view above, there is no problem if a public key is
> used in either Ed448 or Ed448ph. This follows from that if f(x) is a
> sound hash function, then so is f(dom|x) for a fixed prefix "dom".
> 
> With a public key used for both Ed448 and Ed448ph, the internal hash can
> be viewed as a tree-hash mode on top of SHAKE256, such as:
>     without pre-hashing:
>         H(x|M)=SHAKE256(dom00|x|M), or
>     with pre-hashing:
>         H(x|M)=SHAKE256(dom10|x|SHAKE256(dom11|M)),
> where "domXY" follows Bryan's coding with X separating between PureEdDSA
> and HashEdDSA and Y separating between the internal hash and the
> prehash. The security of this domain separation scheme follows from
> checking the sufficient conditions defined in [1].

Seperating between internal hash and prehash is not needed. One can
show that even without prehash prefix any forgery either yields forgery
on the base scheme or is prehash collision. And absolutely no security
is promised in either of those cases.

Furthermore, unless one wants to do random prefixes (which greatly
strengthen signatures), one presumably does not want to deal with
any sorts of prefixes on hashes (and postfixes are pointless),
which tend to force having to calculate hashes multiple times, but
take raw hash value to sign.

OpenPGP works that way. TLS is impiled to work that way. SSH does not
need IUF. Etc...


-Ilari