Re: [Cfrg] draft-irtf-cfrg-eddsa -- one final proposal for domain separation (context labels) for ed25519

[Daniel Kahn Gillmor <[e-mail]>]

On Thu 2016-04-21 15:50:14 -0400, Ilari Liusvaara wrote:
> I actually implemented the scheme (modifying the python reference
> implementation in the draft (modifying H(x) to be SHA512(context|x)).
>
> - Modified and base scheme generate identical signatures and validate
>   identical signatures for empty context (as expected).
> - Signature of ('abc','def') is different from signature of ('abcd','ef')
>   and does not cross-validate. Nor does either cross-validate with
>   ('',abcdef).

Is this because you're including the NUL octet between the context and
the signature, or for some other reason?  if so, then i'd phrase it as:

 signature of ('abc\0', 'def') is different from signature of ('abcd\0', 'ef')

which i think everyone would agree is the right outcome.

Or are you talking about some other scheme?

> [ben kaduk wrote:]
>> From where I am sitting, it seems like there are two options: does
>> the signing API include a context input?  If yes, use that input; if
>> no, prepend the context to the message to be signed in my own code.
>> What am I missing?
>
> This does not work.

Why not?  Can you explain more?

    --dkg