IETF Logo Mail Archive

[CFRG] Re: Silithium - A Compact, Efficient and Non-separable Hybrid Signature

Simon Josefsson <simon@josefsson.org> Wed, 22 July 2026 14:54 UTC

Return-Path: <simon@josefsson.org>
X-Original-To: cfrg@mail2.ietf.org
Delivered-To: cfrg@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id DF46311C68AEF; Wed, 22 Jul 2026 07:54:32 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1784732072; bh=nFE0j3ioHfNy9WwlaJXVYhohLp5kfqfGp98FTpLjWuI=; h=From:To:Cc:Subject:In-Reply-To:References:Date; b=KLnX+HUOCZIC+Ov2ex8f1kxhuLSjHGm+SfG6ZQz/8YJv06yXH4sDkxIKfYUs8PK9B Y4JU+B+GGGJOBMU3h7lXllODoHx/4k8tcqOKleybD+6O2jfuJFEhoYSKE7fnoES33t fC74eWOWPg7sV1hHNVdnQt/7l3BrBwM2uSkRKaxY=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -4.399
X-Spam-Level:
X-Spam-Status: No, score=-4.399 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=neutral reason="invalid (unsupported algorithm ed25519-sha256)" header.d=josefsson.org header.b="Xd8xkVkQ"; dkim=pass (2736-bit key) header.d=josefsson.org header.b="MCQ7aQ5y"
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KAze4uEMTUeL; Wed, 22 Jul 2026 07:54:30 -0700 (PDT)
Received: from uggla.sjd.se (uggla.sjd.se [178.174.241.107]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 4D3FB11C68AE0; Wed, 22 Jul 2026 07:54:29 -0700 (PDT)
DKIM-Signature: v=1; a=ed25519-sha256; q=dns/txt; c=relaxed/relaxed; d=josefsson.org; s=ed2303; h=Content-Type:MIME-Version:Message-ID:Date: References:In-Reply-To:Subject:Cc:To:From:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=nFE0j3ioHfNy9WwlaJXVYhohLp5kfqfGp98FTpLjWuI=; t=1784732067; x=1785941667; b=Xd8xkVkQD81QjZoRmxTqn7B84vciL9egH/nVwRE/vjDuq6sfgVNcD4d2KamhTUg4mzZe88iO3TX Xitnb39kuCQ==;
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=josefsson.org; s=rsa2303; h=Content-Type:MIME-Version:Message-ID:Date: References:In-Reply-To:Subject:Cc:To:From:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=nFE0j3ioHfNy9WwlaJXVYhohLp5kfqfGp98FTpLjWuI=; t=1784732067; x=1785941667; b=MCQ7aQ5yOCCes/ZFoJUgEEoawy9AQvOQBU3ZwXo3Km2fhhtvJ0frt3U315I1Zexe5J8FkCatH7A dXJuNxswWcYmJv2cK/pJv8R2H3A8ib5HovT6Rg3mAEGmk18csiE6H+qXNEGxvzZmlI3ono3AIY5is Vc/ZvH4Rw0jCEyErOvk/efscFqpCf3ymGf32gyImq4PpZAbJXHDxePbwa6zTF/MlyNNhgudGN+BIR B07q2ohS73CSoMVTROoWz2Ad1WKVdhy0nSQ6T2Ny9QGDoFZ5aMPQ33Mz67LE0gq3OiSyIIxXWQLO7 VQUogGb0gJM6FTLamAvmHM5AHUh4Sm0bP6PLOixyIdGE5bV3KXZ+umlyjHR8d0yR7v1gIWh5UE8YV jX+DYlmhZDwX8Psy/ZssaX/43V0ScZtc9u5IrCBgl2rjgaX6eUWL3iXsNaFopPedidBGpFrBI;
Received: from h-46-59-24-28.na.cust.bahnhof.se ([46.59.24.28]:21753 helo=frallan) by uggla.sjd.se with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from <simon@josefsson.org>) id 1wmYL3-003HD3-1H; Wed, 22 Jul 2026 14:54:25 +0000
From: Simon Josefsson <simon@josefsson.org>
To: John Mattsson <john.mattsson=40ericsson.com@dmarc.ietf.org>
In-Reply-To: <AS4PR07MB88256F0039FB5B01653464BC89C12@AS4PR07MB8825.eurprd07.prod.outlook.com> (John Mattsson's message of "Wed, 22 Jul 2026 14:23:53 +0000")
References: <AS4PR07MB8825735C754B892619638F6989C12@AS4PR07MB8825.eurprd07.prod.outlook.com> <20260722130820.1362486.qmail@cr.yp.to> <AS4PR07MB88256F0039FB5B01653464BC89C12@AS4PR07MB8825.eurprd07.prod.outlook.com>
OpenPGP: id=B1D2BD1375BECB784CF4F8C4D73CF638C53C06BE; url=https://josefsson.org/key-20190320.txt
X-Hashcash: 1:23:260722:cfrg@irtf.org::87FsfWNrewsnRbzO:8gSo
X-Hashcash: 1:23:260722:djb@cr.yp.to::xkIMhZYt/38BU24b:OjGW
X-Hashcash: 1:23:260722:john.mattsson=40ericsson.com@dmarc.ietf.org::76QhzOxq4VSCd/HZ:ePdR
Date: Wed, 22 Jul 2026 16:56:07 +0200
Message-ID: <87wlunysxk.fsf@josefsson.org>
User-Agent: Gnus/5.13 (Gnus v5.13)
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-="; micalg="pgp-sha512"; protocol="application/pgp-signature"
Message-ID-Hash: 7OFNCKEEBMTJ2FYBWN5WAPAKTHDCVJRI
X-Message-ID-Hash: 7OFNCKEEBMTJ2FYBWN5WAPAKTHDCVJRI
X-MailFrom: simon@josefsson.org
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-cfrg.irtf.org-0; header-match-cfrg.irtf.org-1; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: "D. J. Bernstein" <djb@cr.yp.to>, "cfrg@irtf.org" <cfrg@irtf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [CFRG] Re: Silithium - A Compact, Efficient and Non-separable Hybrid Signature
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/rp8M_ndO2BdPQEg4lTGB4jVJank>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Owner: <mailto:cfrg-owner@irtf.org>
List-Post: <mailto:cfrg@irtf.org>
List-Subscribe: <mailto:cfrg-join@irtf.org>
List-Unsubscribe: <mailto:cfrg-leave@irtf.org>

John Mattsson <john.mattsson=40ericsson.com@dmarc.ietf.org> writes:

> Hedged signing computes
>
> r' = H(r, m)

That ordering is an argument for using SHAKE and not length-extension
vulnerable SHA2, for defence-in-depth.

Or a keyed PRF and including the secret key as well...

/Simon

v2.46.0 | Report a Bug | By Email | System Status