Re: [Cfrg] Outline -> was Re: normative references

[Paul Lambert <[e-mail]>]

Hi Kevin,

⨳|> A truly ‘unified' public key system would support both signatures
 ⨳|and
 ⨳|> key establishment with the same key.
 ⨳|>
 ⨳|
 ⨳|Received wisdom is that using the same key for both key establishment
 ⨳|and signatures is a bad idea.  I believe the concern is that one
 ⨳|protocol might be used an Oracle to subvert the other.
[ ⨳]
Yes - greatly appreciate the transfer of wisdom.  General guidelines are well documented to this effect.

This makes complete sense in the general case where a curve may support generic  key establishment or signature algorithms.

However, for specifically selected signature and key establishment methods I would assume that and examination could be made of this potential subversion.  The general guideline seems to be blocking the examination and evaluation of the sensitivity of such combined modes.

As a protocol designer, being able to use the same key for signatures and key establishment makes for a simpler design and trust model.  The session key security (e.g. from ECDH) would be implicitly bound to the any signed information from the same key.  

I is possible to just consider a combined public key that is the concatenation of two types ... but then you need another mechanism to validate the binding.  Right now if you have two public keys Pe and Ps (public to sign and public to encrypt) This would be P = Pe|Ps ( concatenated).  Binding could through and be Id = h(P)=h(Pe|Ps) or 
Ps signing Pe, etc.

Still ... it doubles the effective required key size and adds additional steps in an authenticated key exchange.

Thanks,

Paul