Re: [Cfrg] Help with the use of contexts

["D. J. Bernstein" <[e-mail]>]

Adam Langley writes:
> The way that this is constructed (due to me) is generic for any
> signature scheme. (Basically just have the context string be
> NUL-terminated at the beginning of the signed message.)

In other words, there's still a simple sign-a-message layer that uses
the standard signature API, that works with all signature systems, and
that minimizes costs for implementors and auditors. On top of this
there's a universal

   def sign_a_context_and_data(c,d):
     if '\0' in c: raise Exception('NUL not allowed in contexts')
     return sign(c + '\0' + d)

layer used by the protocol (and by any other protocols that want it).
Everyone can see how this works from a spec perspective and from a
software-engineering perspective.

For comparison, trying to modify the interface and specification of
every sign() function creates a transition nightmare, with nobody able
to answer basic questions about how this approach is actually supposed
to work. What's the advantage supposed to be?

I would really like to see this unnecessary complexity eliminated from
CFRG's signature specifications. Please see

   https://www.ietf.org/mail-archive/web/cfrg/current/msg08167.html

for further comments.

---Dan