Re: [Cfrg] EC - next steps to get draft-irtf-cfrg-curves done

[Andrey Jivsov <[e-mail]>]

On 02/10/2015 02:14 PM, Tony Arcieri wrote:
> On Tue, Feb 10, 2015 at 2:07 PM, Andrey Jivsov <[e-mail] 
> <mailto:[e-mail]>> wrote:
>
>     The above reads a bit odd. Often the hash function cannot be
>     perfectly matches to the curve size, thus the expansion or
>     contraction rules are defined and relied upon.
>
>     e.g. one can use SHA-256 with P-384.
>
>
> Can you show me an ECDSA specification that says it's allowed to use 
> SHA-256 with P-384?
>
> -- 
> Tony Arcieri

http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf sec "4.6 DSA 
Signature Generation" for DSA defines the truncation/expansion.

Sec "6.4 ECDSA Digital Signature Generation and Verification" discusses 
the implications of mismatch of the strength of the hash function. The 
section then prescribes:

"When the length of the output of the hash function is greater than the 
bit length of n, then the leftmost n bits of the hash function output 
block shall be used in any calculation using the hash function output 
during the generation or verification of a digital signature." The 
section also says that weaker hash function "ordinarily should not be 
used", but doesn't prohibit this (otherwise why discuss the implications 
of the mismatch earlier in the section?).

Because weaker hash is an implicit default in many online protocols and 
in offline protocols you never know the capabilities of all the 
verifiers, please consider that prohibiting P-384 with SHA-256 would 
have an effect of punishing these who want stronger security of P-384 
(or a single X.509 cert that works for all security levels).