[Cfrg] Open Issue List for draft-irtf-cfrg-eddsa-06

[Jim Schaad <[e-mail]>]

The following is what I would consider to be on my open issue list for this
draft to get to approval.  I have tried to triage the list according to my
priorities.


High Priority:

1.  Fix the known security issue with EdDSA25519 and EdDSA25119ph:  I have
provided what I consider to be an elegant solution for this with the
modification from Ilari
(https://mailarchive.ietf.org/arch/msg/cfrg/VkBtpUwNIJ1JFAka1NljgBXgwVo)
And I was not the first, but my presentation is slightly different.

Moderate Priority:

1.  Remove the dom function from Ed448ph

Low Priority:

1.  In section 5.1.7, explain the trade-off between the two formulas and why
one is better than the other.

2.  Increase the size of the output of the Ed448ph if the security is not
consistent between the 448 bit curve and the 512 bit hash.  It just looks
odd because Ed25519 also uses a 512 bit pre-hash function.   My guess is
that nothing needs to be done, but an explanation might be useful.

3.  Define the ctx version of EdDSA25519.   It would be nice, esp if we
think that the context version is better even with null contexts, but if we
solve the first issue this can be done later if we decide it is preferable.

I don't care anymore:

1. Change the Ed448ph function to be a hash function rather than an XOR.  It
appears as long as the length is a known constant the two are equivalent for
all intents and purposes.
2. Previous issues that I raised with the python code.  My code is working
it no longer bothers me anymore.


Jim