Re: [Cfrg] draft-irtf-cfrg-eddsa -- one final proposal for domain separation (context labels) for ed25519

[Martin Thomson <[e-mail]>]

On 6 May 2016 at 20:17, Ilari Liusvaara <[e-mail]> wrote:
>
> So yeah, just use separate keys. Don't cause problems for everybody
> by using contexts.

As an author of a document that defines the use of contexts, how do
you reconcile this view with what the document says?

I agree with the idea that there is a moral superiority in using
different keys.  That's an inarguable statement from a position of
great integrity.

djb's one-bit protocol examples highlight that there is an inherent
futility in attempting domain isolation at any layer of a protocol
stack that might conceivably be used in support of some high-layer
protocol.

But I see those examples as illustrative of an insufficient degree of
redundancy.  For, if ever there were fans of redundancy, it would be
the military.  While conceivably you could build a protocol that
defers all self-identification and context to the crypto that supports
it, in the cases illustrated, it shows itself as unwise in the extreme
in light of the propensity of people to do bad things.

We find that reuse of signature keys for different purposes is rife in
the real world.  A firm requirement of TLS 1.3 is that existing keys
can be used with the new protocol.  It would not deploy otherwise, and
yet we endorse that which we all agree to be a sin and do what we can
to avoid problems.

When signature keys are used to identify, I predict that they will
definitely be misused in this fashion.  I've seen it many times
already, and don't imagine that any edict from the CFRG will change
that.

I disagree with the notion of there being "serious" or "fundamental"
usability problems.  You are correct in that these are not perfect
bijective mappings from one domain to another, particularly when there
are existing users of the signature scheme.  However, you are
perfectly reasonable in noting that people are using Ed25519 and so
suggesting that they instead use some newly defined Ed25519ctx for
some marginal benefit (domain separation) is not in their interests.

Take the suggestion for what it is: a backstop for when good sense fails.