Re: [Cfrg] draft-irtf-cfrg-eddsa -- one final proposal for domain separation (context labels) for ed25519

[Ilari Liusvaara <[e-mail]>]

On Fri, Apr 22, 2016 at 08:37:28PM +1000, Martin Thomson wrote:
> On 22 April 2016 at 19:16, Ilari Liusvaara <[e-mail]> wrote:
> > On Fri, Apr 22, 2016 at 05:26:37PM +1000, Martin Thomson wrote:
> >> On 22 April 2016 at 16:21, Ilari Liusvaara <[e-mail]> wrote:
> >> > H(x)=SHA512(context|x) does not cause behaviour like Ed25519(key,context|x)
> >> > when applied.It causes behaviour that can't be expressed using the base
> >> > Ed25519 primitive.
> >>
> >> I don't know why we got hung up on that concept.  PH(x) =
> >> SHA512(context || x) might be closer to what we've been thinking of.
> >
> > 1) That only 'works' with Ed25519ph. And even with that, you do not
> > want the context inside data hash.
> 
> I don't know what you want, but maybe you could tell me why I don't want that.

1) More vulernable to attacks there.
2) You need the context outside it anyway for non-prehashed version
   (if you do contexts).
 
> > 2) You definitely do not want that kind of context schemes on non-
> > context keys. Even the prepending the context in hash (without
> > separation) makes me VERY uneasy.
> 
> Well, it's how everyone is forced to do things if the primitive
> doesn't have native contexts.  I agree that it could be better, but
> I'm not going to lose sleep over it.

Or just split on key. May be bit painful (and sometimes not possible
at all, e.g. TLS versus CSR) but much better than dealing with the
API mess.

> I'm having a hard time understanding what you want out of this
> conversation.  Maybe you could try to explain whether you think that
> context is a good idea and maybe how you would prefer that we solve
> the problem.

It is not possible to retrofit contexts into Ed25519 in a way that
I would be even remotely comfortable with. This is because Ed25519
lacks any space to put any extensions to.

Just adding contexts to Ed25519 without splitting variant would
leave it open for trivial attacks (or cryptographic screwedness
I really do not want to see).

If you split variant, you can do whatever is desired, eg. fit
Ed448-style context and hash indicator (which would also solve
problems with Ed25519ph).


-Ilari