[CFRG] Re: [EXT] Re: Adoption Call: Sigma Protocols

[Christopher Patton <[e-mail]>]

Jon,

FWIW, I believe the (interactive versions of the) Sigma protocols under
> consideration are unconditionally secure, i.e., special soundness and
> honest-verifier zero knowledge hold without any computational assumptions.
> (Of course, the protocols may not be very useful if DLOG is not hard...)
> The non-interactive versions require modeling the hash function being used
> as a random oracle for some appropriate notion of extraction to hold.
>

Thanks for clarifying! Given this, I think it would be sensible to go with
a smaller and/or more conventional curve for the doc. I find P384 a bit
misleading, as it makes me think there's something about this application
that requires a larger security margin.

I think Watson is correct (downthread) that the application will end up
choosing its own curve, but I think the document should suggest the most
efficient default that is safe to use.

Chris P.