[Cfrg] Poll Results: hash functions for Ed448

[Alexey Melnikov <[e-mail]>]

On 08/12/2015 15:30, Alexey Melnikov wrote:
> This message starts 2 weeks Quaker Poll on hash functions to be used for
> definition of Ed448 in draft-irtf-cfrg-eddsa. Please reply for each choice:
> +1, if you prefer a particular choice
> 0, if you can live with it
> -1, if you are against a particular choice
> 
> Choices are:
> 
> 1) "twoshakes-s", (SHAKE256@912(x) for the internal hash,
> SHAKE256@512(x) as the prehash)
> 
> More details:
> <http://www.ietf.org/mail-archive/web/cfrg/current/msg07629.html>
> 
> 2) "twoshakes-d",
> 
> This scheme again uses the SHAKE256 extensible-output functions (XOFs)
> to implement both hashes, with the inputs prefixed as specified below
> for explicit domain separation purposes.
> 
> More details:
> <http://www.ietf.org/mail-archive/web/cfrg/current/msg07629.html>
> 
> 3) "simon1" (SHAKE256@912(x) for the internal hash, SHA3-512 as the
> prehash).
> 
> 4) "simon2" (Use SHA2-512/912 as described in [1] as the internal hash
> and SHA2-512 as the prehash).
> 
> [1] - <http://ed25519.cr.yp.to/eddsa-20150704.pdf>
> 
> 5) "ilari1" (SHAKE256@912bits(x) for the internal hash, SHA2-512(x) as
> the prehash)
> 
> More details:
> <http://www.ietf.org/mail-archive/web/cfrg/current/msg07644.html>
> 
> 6) "ilari2"
> 
> Hash: HKDF-EXPAND(hash=SHA2-512, prk=HKDF-EXTRACT(hash=SHA2-512,
> salt=<blank>, ikm=x), info=<blank>, 114) Prehash: SHA2-512(x)
> 
> More details:
> <http://www.ietf.org/mail-archive/web/cfrg/current/msg07644.html>
> 
> 7) You can specify an alternative proposal, if you wish


After reviewing all messages received it looks like twoshakes-d is the
first choice and simon2 is a distant second.