Re: [Cfrg] key as message prefix => multi-key security

"D. J. Bernstein" <djb@cr.yp.to> Fri, 18 September 2015 01:49 UTC

Date: Fri, 18 Sep 2015 01:49:07 -0000
Message-ID: <20150918014907.6698.qmail@cr.yp.to>
From: "D. J. Bernstein" <djb@cr.yp.to>
To: cfrg@irtf.org
Mail-Followup-To: cfrg@irtf.org
In-Reply-To: <20150917234631.5681236.29412.6964@certicom.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/cfrg/v0TLXDdYdUyHwDPB77mDaa9m_MY>
Subject: Re: [Cfrg] key as message prefix => multi-key security
Precedence: list

Dan Brown writes:
> Aside: does this proof work for H(A,R,M) too?

As doctors say: First, do no HARM. :-)

In all seriousness: The proof applies, but relative to a new hash
function H' that's just like H but swaps the first and second chunks of
input. Nobody would expect this to matter for Schnorr in the typical
case that the block size of H is big enough for both chunks.

---Dan

[Cfrg] EC signature: next steps Alexey Melnikov
Re: [Cfrg] EC signature: next steps Simon Josefsson
Re: [Cfrg] EC signature: next steps Watson Ladd
[Cfrg] EC signature: next steps Dan Brown
Re: [Cfrg] EC signature: next steps Ilari Liusvaara
Re: [Cfrg] EC signature: next steps Stephen Farrell
Re: [Cfrg] EC signature: next steps Dan Brown
Re: [Cfrg] EC signature: next steps Simon Josefsson
Re: [Cfrg] EC signature: next steps Ilari Liusvaara
[Cfrg] Side inputs to signature systems D. J. Bernstein
Re: [Cfrg] Side inputs to signature systems Natanael
Re: [Cfrg] EC signature: next steps Simon Josefsson
Re: [Cfrg] Side inputs to signature systems Michael Hamburg
Re: [Cfrg] EC signature: next steps Rene Struik
Re: [Cfrg] EC signature: next steps David Jacobson
Re: [Cfrg] EC signature: next steps Mike Hamburg
Re: [Cfrg] EC signature: next steps William Whyte
Re: [Cfrg] EC signature: next steps Stephen Farrell
Re: [Cfrg] EC signature: next steps Blumenthal, Uri - 0553 - MITLL
Re: [Cfrg] EC signature: next steps Ilari Liusvaara
Re: [Cfrg] EC signature: next steps Stephen Farrell
Re: [Cfrg] EC signature: next steps Blumenthal, Uri - 0553 - MITLL
Re: [Cfrg] EC signature: next steps Blumenthal, Uri - 0553 - MITLL
Re: [Cfrg] EC signature: next steps Blumenthal, Uri - 0553 - MITLL
Re: [Cfrg] key as message prefix => multi-key sec… Dan Brown
[Cfrg] key as message prefix => multi-key security D. J. Bernstein
Re: [Cfrg] key as message prefix => multi-key sec… D. J. Bernstein
Re: [Cfrg] key as message prefix => multi-key sec… Paterson, Kenny
Re: [Cfrg] key as message prefix => multi-key sec… Sven Schäge
Re: [Cfrg] key as message prefix => multi-key sec… Blumenthal, Uri - 0553 - MITLL
Re: [Cfrg] key as message prefix => multi-key sec… William Whyte
Re: [Cfrg] key as message prefix => multi-key sec… Bill Cox
Re: [Cfrg] key as message prefix => multi-key sec… Andrey Jivsov
Re: [Cfrg] key as message prefix => multi-key sec… D. J. Bernstein
Re: [Cfrg] key as message prefix => multi-key sec… D. J. Bernstein
Re: [Cfrg] key as message prefix => multi-key sec… D. J. Bernstein
Re: [Cfrg] key as message prefix => multi-key sec… Eike Kiltz
Re: [Cfrg] key as message prefix => multi-key sec… D. J. Bernstein
Re: [Cfrg] key as message prefix => multi-key sec… Simon Josefsson