IETF Logo Mail Archive

Re: [Cfrg] Message Digest Algorithm Choice for CMS with Ed448

Taylor R Campbell <campbell+cfrg@mumble.net> Mon, 14 November 2016 23:31 UTC

Return-Path: <campbell@mumble.net>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 293CE129532 for <cfrg@ietfa.amsl.com>; Mon, 14 Nov 2016 15:31:57 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.397
X-Spam-Level:
X-Spam-Status: No, score=-3.397 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-1.497] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kO78OoQLQPbk for <cfrg@ietfa.amsl.com>; Mon, 14 Nov 2016 15:31:55 -0800 (PST)
Received: from jupiter.mumble.net (jupiter.mumble.net [74.50.56.165]) by ietfa.amsl.com (Postfix) with ESMTP id DD1EE129528 for <cfrg@irtf.org>; Mon, 14 Nov 2016 15:31:55 -0800 (PST)
Received: by jupiter.mumble.net (Postfix, from userid 1014) id 7FD31603CA; Mon, 14 Nov 2016 23:31:44 +0000 (UTC)
From: Taylor R Campbell <campbell+cfrg@mumble.net>
To: Jim Schaad <ietf@augustcellars.com>
In-reply-to: <06d301d23ecc$402eb8e0$c08c2aa0$@augustcellars.com> (ietf@augustcellars.com)
Date: Mon, 14 Nov 2016 23:31:54 +0000
Sender: Taylor R Campbell <campbell@mumble.net>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Message-Id: <20161114233144.7FD31603CA@jupiter.mumble.net>
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/pt0vHmtr1qLcIPfzo8beb49hbiw>
Cc: IRTF CFRG <cfrg@irtf.org>, Russ Housley <housley@vigilsec.com>, "Scott Fluhrer (sfluhrer)" <sfluhrer@cisco.com>
Subject: Re: [Cfrg] Message Digest Algorithm Choice for CMS with Ed448
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Mon, 14 Nov 2016 23:31:57 -0000

   Date: Tue, 15 Nov 2016 08:10:08 +0900
   From: Jim Schaad <ietf@augustcellars.com>

   Please note that the following is how CMS works

   Sign( list of attributes )
   List of attributes contains a hash of the message along with other items
   such as a time, which signature algorithm, which hash algorithm, potentially
   which certificate(s) to use for verification.

   For this exercise, we are looking what to use for the hash of message, the
   sign operation is using EdDSA pure.

If you are limited to choosing a single fixed public hash function H
so that the message m figures into the rest of the system only via
H(m), then it is essential to choose H so that it has collision
resistance at the desired security level, e.g. SHAKE256-512 for a
256-bit security level.

(SHA3-512 does too but is excessively slow for that security level.
The CFRG's EdDSA draft uses SHAKE256 rather than SHA3-512 for this
reason.)

v2.23.0 | Report a Bug | By Email