Re: [Curdle] AD Review: draft-ietf-curdle-cms-eddsa-signatures-05.txt

[Russ Housley <[e-mail]>]

> TECHNICAL
> S 3.1 and 3.2.
> - Is there some reason to not prescribe exactly one form here?
>   I.e., require id-sha512 (etc.) or require it not be there?
> 
> - Also, TLS has converged on talking about an "identity" hash
>   for the PureEd forms. Was this discussed and rejected?

CMS supports signatures with and without signed attributes.  In most cases, signed attributes are present.  When signed attributes are present, the message-digest attribute MUST be one of the attributes.  Eric is suggesting that the “identity” hash could be used with Ed25519 and Ed448 when there are no attributes to hash.  Using ED25519 as an example, we get:

   IF (signed attributes are absent)
   THEN
	signedData.digestAlgorithms includes id-hashIdentity
        signedData.signerInfo.digestAlgorithm = id-hashIdentity
        signedData.signerInfo.signature = Ed25519(content)
   ELSE
	signedData.digestAlgorithms includes id-sha512
        signedData.signerInfo.digestAlgorithm = id-sha512
	signedData.signerInfo.signedAttrs includes message-digest = SHA512(content)
        signedData.signerInfo.signature = Ed25519(DER(signedData.signerInfo.signedAttrs))

Do others think the use of an algorithm identifier for the “identity” hash is better?  The current document include id-sha512 as a warning that Ed25519 uses that hash algorithm internally.

Russ