[Cfrg] Re: Message Digest Algorithm Choice for CMS with Ed448

Russ Housley <housley@vigilsec.com> Sun, 20 November 2016 01:04 UTC

Return-Path: <housley@vigilsec.com>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6AE6B129488 for <cfrg@ietfa.amsl.com>; Sat, 19 Nov 2016 17:04:38 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -101.9
X-Spam-Level:
X-Spam-Status: No, score=-101.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4lxLeWmr5qTa for <cfrg@ietfa.amsl.com>; Sat, 19 Nov 2016 17:04:36 -0800 (PST)
Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B7CCA1293E1 for <cfrg@irtf.org>; Sat, 19 Nov 2016 17:04:36 -0800 (PST)
Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 272E8300ADA for <cfrg@irtf.org>; Sat, 19 Nov 2016 19:54:19 -0500 (EST)
X-Virus-Scanned: amavisd-new at mail.smeinc.net
Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id bK-4tyeaztcw for <cfrg@irtf.org>; Sat, 19 Nov 2016 19:54:17 -0500 (EST)
Received: from [10.35.131.136] (unknown [58.123.138.206]) by mail.smeinc.net (Postfix) with ESMTPSA id 2AB03300429 for <cfrg@irtf.org>; Sat, 19 Nov 2016 19:54:16 -0500 (EST)
Content-Type: text/plain; charset=windows-1252
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\))
From: Russ Housley <housley@vigilsec.com>
X-Priority: 1
Date: Sat, 19 Nov 2016 20:04:27 -0500
Content-Transfer-Encoding: quoted-printable
Message-Id: <AAC0DF79-5420-460D-9F9B-8DBE9D803721@vigilsec.com>
References: <20161116083137.GA8403@LK-Perkele-V2.elisa-laajakaista.fi>
To: IRTF CFRG <cfrg@irtf.org>
X-Mailer: Apple Mail (2.1878.6)
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/wEoUhjPDYR-9d2cOXPGD64M1JM4>
Subject: [Cfrg] Re: Message Digest Algorithm Choice for CMS with Ed448
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Sun, 20 Nov 2016 01:04:38 -0000

>> I’d like to summarize what I have heard.  Either SHA3-512 or
>> SHAKE256-512 provide the necessary protection.  Both of these
>> use Keccak, and both produce a 512-bit result.  SHAKE256 is
>> more efficient.
>> 
>> I wrote a small test program, and it confirms that SHAKE256
>> is more efficient than SHA3-512.
> 
> Note that from theoretical grounds, one gets that SHAKE256 is supposed
> to have 89% higher throughput than SHA3-512 (or equivalently hashing
> takes 47% less time) over long messages.
> 
> This if from the fact that SHAKE256 packs 136 data octets into each
> block, whereas SHA3-512 only packs 72. And the algorithm to process
> each block is the same. So SHAKE256 processes about 136 octets in the
> same time as SHA3-512 processes 72.
> 
> The security level difference is in preimage resistance (512->256
> bits), but 256 bit security level is more than sufficient here,
> given that the curve is weaker than that.
> 
> Output length adjustment to "match security levels" is not helpful,
> given that the block counts will be the same anyway.
> 
> Also, I hope that there is some envelope around the raw SHAKE256
> result. Otherwise the result is the same as Ed448ph, except without
> the TBS collision protection w.r.t. Ed448.


Ilari:

I believe the ASN,1 encoding of the signed attributes provides the “envelope around” the SHAKE256-512 result.

I just posted an updated Internet-Draft:
https://www.ietf.org/id/draft-ietf-curdle-cms-eddsa-signatures-01.txt

Thanks,
  Russ