Re: [Cfrg] EdDSA and > 512 curve & hash (Re: [TLS] Additional Elliptic Curves (Curve25519 etc) for TLS ECDH key agreement)

[Adam Back <[e-mail]>]

On Sun, Jan 12, 2014 at 07:13:16AM -0800, Robert Ransom wrote:
>Deterministic generation of message keys is the primary reason that
>EdDSA requires a double-length hash function.
>
>EdDSA relies on the hash function having double-length output in two ways:
>
>* Message key generation relies on the output being noticeably longer
>than the group order in order to generate *uniform* exponents.
>
>* EdDSA also uses the hash function to expand the secret-key bitstring
>into (a) the secret exponent of the public key and (b) a secret
>bitstring used to key the message key generation hash function.

My point is compared to the deterministic CRNG that eg DSA specifies for k
generation, follow that pattern, but using SHA3-512 as the building
block, seeded with d, the private key, is certainly doable to scale EdDSA to
512-bit curve without needing a 1024-bit hash function.

Some KDF functions are designed to provide the needed one-way security
beyond the hash input size of the underlying hash or MAC function.  So I was
suggesting this as an alternative method than using a not-widely-used hash
or hash-parameterization (Keccak).

Adam