Re: [CFRG] An update on Web Crypto, and adopting CFRG curves

[Hubert Kario <[e-mail]>]

On Tuesday, 16 August 2022 15:10:29 CEST, Daniel Huigens wrote:
> On Tuesday, August 16th, 2022 at 14:27, Hubert Kario wrote:
>
>> If we want consistency between implementations of ed25519, I'm afraid that
>> it will be a long road to that:
>> 
>> https://hdevalence.ca/blog/2020-10-04-its-25519am
>
> This (draft) spec aims to standardize & ensure consistency between
> implementations of Ed25519 in Web Crypto only (along with the other
> algorithms), not Ed25519 implementations in general. I agree that would
> be much more difficult.
>
> Of course, an implementation of Web Crypto will still have to call out
> to a crypto library implementing Ed25519 at some point. However, the
> checks proposed in [1] can, in principle, be done by the Web Crypto
> implementation, by checking keys and signatures against a hardcoded
> list of small-order elements. Of course it would be better if the
> crypto library would implement that, though - but often browsers at
> least are also in control of that (e.g. Firefox has NSS and Chrome has
> BoringSSL, a fork of OpenSSL) - so I think that shouldn't be a huge
> issue.
>
> However, if you see some issue with these checks, please let me know.

I'd say that if we want to ensure consistency, there should be test vectors
included for all of those corner cases.
-- 
Regards,
Hubert Kario
Principal Quality Engineer, RHEL Crypto team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic