Re: [Cfrg] Signatures: curves, algorithms, etc

[Damien Miller <[e-mail]>]

On Tue, 27 Jan 2015, Tony Arcieri wrote:

> I would like to hear the opinions of the chairs and other CFRG participants
> on the following:
> - Ed25519 and EdDSA
> - FrankenECDSA (ECDSA in Edwards)
> - ECDSA with Edwards keys on the wire (converted to Weierstrass to do ECDSA)
> - Other interesting thoughts on digital signatures

As you probably already know OpenSSH is already using Ed25519 for
user and host authentication. We chose it because:

1) It's secure; well-reviewed and based on good "bones" (e.g. Schnorr sigs)
1a) It avoids the terrible failure modes of DSA/ECDSA
1b) It's hard for implementors to get wrong
2) It's fast
3) There are excellent reference implementations available

We're not interested in adding more DSA/ECDSA variants unless there is some
compelling reason (and I don't see any). EdDSA just seems a better algorithm.

We're not super-interested in WF >2^128 EdDSA either, but would possibly
consider EdDSA at ~WF 2^256 if our users start asking for it.

We aren't likely to benefit from batch signing/verification.

-d