[Cfrg] Re: Message Digest Algorithm Choice for CMS with Ed448

[Russ Housley <[e-mail]>]

>> I’d like to summarize what I have heard.  Either SHA3-512 or
>> SHAKE256-512 provide the necessary protection.  Both of these
>> use Keccak, and both produce a 512-bit result.  SHAKE256 is
>> more efficient.
>> 
>> I wrote a small test program, and it confirms that SHAKE256
>> is more efficient than SHA3-512.
> 
> Note that from theoretical grounds, one gets that SHAKE256 is supposed
> to have 89% higher throughput than SHA3-512 (or equivalently hashing
> takes 47% less time) over long messages.
> 
> This if from the fact that SHAKE256 packs 136 data octets into each
> block, whereas SHA3-512 only packs 72. And the algorithm to process
> each block is the same. So SHAKE256 processes about 136 octets in the
> same time as SHA3-512 processes 72.
> 
> The security level difference is in preimage resistance (512->256
> bits), but 256 bit security level is more than sufficient here,
> given that the curve is weaker than that.
> 
> Output length adjustment to "match security levels" is not helpful,
> given that the block counts will be the same anyway.
> 
> Also, I hope that there is some envelope around the raw SHAKE256
> result. Otherwise the result is the same as Ed448ph, except without
> the TBS collision protection w.r.t. Ed448.


Ilari:

I believe the ASN,1 encoding of the signed attributes provides the “envelope around” the SHAKE256-512 result.

I just posted an updated Internet-Draft:
https://www.ietf.org/id/draft-ietf-curdle-cms-eddsa-signatures-01.txt

Thanks,
  Russ