Re: [Cfrg] Message Digest Algorithm Choice for CMS with Ed448

[Russ Housley <[e-mail]>]

I’d like to summarize what I have heard.  Either SHA3-512 or SHAKE256-512 provide the necessary protection.  Both of these use Keccak, and both produce a 512-bit result.  SHAKE256 is more efficient.

I wrote a small test program, and it confirms that SHAKE256 is more efficient than SHA3-512.

Looking at the NIST web pages, the algorithm identifier for SHA3-512 has been defined, but the only algorithm identifier for SHAKE256 has a 256-bit result.  Quynh Dang says he can help with that.

For the SHAKE256 algorithm identifier, I am thinking about something like this:

      hashAlg-SHAKE256  ALGORITHM ::= { OID id-TBD
                                        PARMS SHAKE256OutputSize }

      SHAKE256OutputSize  ::=  INTEGER  -- Output size in bits

Russ


On Nov 12, 2016, at 10:55 PM, Russ Housley <[e-mail]> wrote:

> The CURDLE WG is working on a document that specifies the
> conventions for using EdDSA with CMS [RFC5652].  See
> draft-ietf-curdle-cms-eddsa-signatures. 
> 
> The most common case involves these steps:
> 
>   1.  Compute a message digest on the content.
> 
>   2.  Create a message-digest attribute that include the 
>       result from 1.
> 
>   3.  Gather all of the attributes that will be signed, which
>       includes the attribute from 2.
> 
>   4.  Digitally sign the set of attributes.
> 
> For Ed448 (EdDSA with Curve448), step 4 uses SHAKE256.
> 
> SHAKE256 uses SHA3-512 internally.
> 
> What message digest algorithm should be used in step 1?
> 
> It seems that SHA3-512 would be a good choice to avoid
> having to implement more that one message digest algorithm
> to generate the signature or validate it.
> 
> Russ