Re: [Cfrg] Message Digest Algorithm Choice for CMS with Ed448

Russ Housley <housley@vigilsec.com> Wed, 16 November 2016 07:22 UTC

Return-Path: <housley@vigilsec.com>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3522912954A for <cfrg@ietfa.amsl.com>; Tue, 15 Nov 2016 23:22:31 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -101.9
X-Spam-Level:
X-Spam-Status: No, score=-101.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qnJtDCFNBA_n for <cfrg@ietfa.amsl.com>; Tue, 15 Nov 2016 23:22:30 -0800 (PST)
Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 12E931294D3 for <cfrg@irtf.org>; Tue, 15 Nov 2016 23:22:30 -0800 (PST)
Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 64C5B300AC5 for <cfrg@irtf.org>; Wed, 16 Nov 2016 02:12:12 -0500 (EST)
X-Virus-Scanned: amavisd-new at mail.smeinc.net
Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id DnM8muVkhAWC for <cfrg@irtf.org>; Wed, 16 Nov 2016 02:12:11 -0500 (EST)
Received: from dhcp-97b7.meeting.ietf.org (dhcp-97b7.meeting.ietf.org [31.133.151.183]) by mail.smeinc.net (Postfix) with ESMTPSA id C58393005AD for <cfrg@irtf.org>; Wed, 16 Nov 2016 02:12:10 -0500 (EST)
Content-Type: text/plain; charset=windows-1252
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\))
From: Russ Housley <housley@vigilsec.com>
In-Reply-To: <7DDD1353-96FC-4E70-8427-AA9C6F499232@vigilsec.com>
Date: Wed, 16 Nov 2016 02:22:24 -0500
Content-Transfer-Encoding: quoted-printable
Message-Id: <E07E9956-F0E9-4992-917C-8DA96CDE8252@vigilsec.com>
References: <7DDD1353-96FC-4E70-8427-AA9C6F499232@vigilsec.com>
To: IRTF CFRG <cfrg@irtf.org>
X-Mailer: Apple Mail (2.1878.6)
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/uPeX4x0pvM3cdiBwvIOyyZJfVvE>
Subject: Re: [Cfrg] Message Digest Algorithm Choice for CMS with Ed448
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Wed, 16 Nov 2016 07:22:31 -0000

I’d like to summarize what I have heard.  Either SHA3-512 or SHAKE256-512 provide the necessary protection.  Both of these use Keccak, and both produce a 512-bit result.  SHAKE256 is more efficient.

I wrote a small test program, and it confirms that SHAKE256 is more efficient than SHA3-512.

Looking at the NIST web pages, the algorithm identifier for SHA3-512 has been defined, but the only algorithm identifier for SHAKE256 has a 256-bit result.  Quynh Dang says he can help with that.

For the SHAKE256 algorithm identifier, I am thinking about something like this:

      hashAlg-SHAKE256  ALGORITHM ::= { OID id-TBD
                                        PARMS SHAKE256OutputSize }

      SHAKE256OutputSize  ::=  INTEGER  -- Output size in bits

Russ


On Nov 12, 2016, at 10:55 PM, Russ Housley <housley@vigilsec.com> wrote:

> The CURDLE WG is working on a document that specifies the
> conventions for using EdDSA with CMS [RFC5652].  See
> draft-ietf-curdle-cms-eddsa-signatures. 
> 
> The most common case involves these steps:
> 
>   1.  Compute a message digest on the content.
> 
>   2.  Create a message-digest attribute that include the 
>       result from 1.
> 
>   3.  Gather all of the attributes that will be signed, which
>       includes the attribute from 2.
> 
>   4.  Digitally sign the set of attributes.
> 
> For Ed448 (EdDSA with Curve448), step 4 uses SHAKE256.
> 
> SHAKE256 uses SHA3-512 internally.
> 
> What message digest algorithm should be used in step 1?
> 
> It seems that SHA3-512 would be a good choice to avoid
> having to implement more that one message digest algorithm
> to generate the signature or validate it.
> 
> Russ