Re: [Curdle] Comments on draft-housley-cms-eddsa-signatures

This would definitely be one approach to solving my issue.  The second would
be to define a new OID which takes an integer parameter which is the size of
the desired output.

Jim

-----Original Message-----
From: Curdle [mailto:curdle-bounces@ietf.org] On Behalf Of Martin Thomson
Sent: Sunday, May 08, 2016 6:23 PM
To: Dang, Quynh (Fed) <quynh.dang@nist.gov>
Cc: Jim Schaad <ietf@augustcellars.com>; Russ Housley
<housley@vigilsec.com>; curdle@ietf.org
Subject: Re: [Curdle] Comments on draft-housley-cms-eddsa-signatures

On 6 May 2016 at 21:16, Dang, Quynh (Fed) <quynh.dang@nist.gov> wrote:
> For ed25519 and ed448 EdDSA signatures, hash algorithm OID should be
null/absent. For ed25519ph and ed448ph, the hash algorithm is the prehash
function: SHA512 for ed25519ph and SHAKE256/512 for ed448ph.

The decision in TLS was to treat signature and hash as a single primitive,
rather than a composable one, since these are not composable anyway. And
Russ has suggested to drop the *ph versions, which is a good idea.

That suggests no need to identify SHAKE* with respect to the signatures,
only to use in other parts of the CMS that need hashes.
And only where you want the hashes to be consistent throughout.

Could Jim's concern about size be addressed by defining different OIDs for
different output sizes?

_______________________________________________
Curdle mailing list
Curdle@ietf.org
https://www.ietf.org/mailman/listinfo/curdle