Re: [Curdle] Comments on draft-housley-cms-eddsa-signatures

[Russ Housley <[e-mail]>]

On May 5, 2016, at 4:47 PM, Jim Schaad <[e-mail]> wrote:

>> A second worry is that SHAK256 is defined as being an XOF function and 
>> not a hash function.  I think it might make more sense to say that we 
>> should be using SHA3-256 rather than SHAKE256.  In any event the OID 
>> assigned on the NIST web site does not make any statements about the 
>> size of output of
>> SHAKE256 and if we are going to use it as a hash algorithm here we 
>> need to do that.  Suffice it to say that I don't think that using 
>> SHAKE256 as a hash algorithm here is sufficiently defined.
> 
> Doesn't this need to be addressed in draft-irtf-cfrg-eddsa?
> 
> [JLS] No, I am not worried about how SHAKE256 is being used in the EdDSA
> process (it is fully defined there), I am looking at the use of SHAKE256
> when it is placed in the digestAlgorithm attribute of the SignerInfo
> structure.  In this case the length of the output needs to be specified
> (i.e. how long is the message digest signed attribute).  This is defined for
> hash algorithms, but is not defined for XOF functions.

I was not understanding you issue until now…

You are worried about this:

       Compute SHAKE256(dom(F, C) || prefix || M, 114), where M is the
       message to be signed, …

Maybe we just make M = SHA512(ValueOnly(DER(SignedAttrs)))

Russ