Re: [Cfrg] On the differences of Ed25519/448 and how it affects a vote on twoshakes-d

[Alexey Melnikov <[e-mail]>]

Hi Tony,

On 13/12/2015 08:13, Tony Arcieri wrote:
> On Sat, Dec 12, 2015 at 12:47 AM, Bryan A Ford <[e-mail]
> <mailto:[e-mail]>> wrote:
> 
>     Interesting - I agree with most of your reasoning but it leads me to the
>     opposite conclusion.  Namely, this makes me feel less concerned about
>     Ed448 being a bit inconsistent with Ed25519 by virtue of having extra
>     "conservative security features" like domain separation.  While indeed
>     most everyone agrees that Ed25519 is probably good enough for most
>     purposes, Ed448's main "raison d'etre" is to have an additional/backup
>     alternative with even more conservative security parameters - i.e., from
>     "good enough" (255-bit curve) to "insane" security (448-bit curve).
>     >From that viewpoint, it doesn't seem at all inconsistent with Ed448's
>     basic purpose for it to have additional conservative security features
>     that Ed25519 doesn't, such as explicit domain separation.
> 
> 
> This is something I'm a bit confused about and could perhaps use some
> clarification from the chairs about...
> 
> I had also originally assumed that the Ed448 hash choice(s) were a sort
> of "spinal tap grade" option to switch over to in the event of a
> disastrous Ed25519 failure, but...
> 
> Is it that, or is this to be a future framework for additional elliptic
> curve signatures? When it comes time to standardize CFRG signatures for
> e.g. FourQ, will Ed25519 be treated as legacy and the decisions around
> Ed448 be treated as standard operating procedure. Or will the debate
> start over from the beginning?

My personal preference would be to use the decision for 448 as the
future template, however I realize that that might be a rathole I would
rather not descend into right now.

So realistically, if CFRG ever to recommend another EC curve, we would
have to [quicly] revisit hash choices. As a co-chair, I would like to
see a justification why future hash choices would be different from what
we pick for Ed448.

> I think it would be nice if there were a standard signature framework
> that could be used for future curves without restarting the bikeshedding
> debate again from the beginning.