Re: [Curdle] AD Review: draft-ietf-curdle-cms-eddsa-signatures-05.txt

[Nikos Mavrogiannopoulos <[e-mail]>]

On Mon, 2017-05-08 at 13:32 -0400, Russ Housley wrote:
> > TECHNICAL
> > S 3.1 and 3.2.
> > - Is there some reason to not prescribe exactly one form here?
> >   I.e., require id-sha512 (etc.) or require it not be there?
> > 
> > - Also, TLS has converged on talking about an "identity" hash
> >   for the PureEd forms. Was this discussed and rejected?
> 
> CMS supports signatures with and without signed attributes.  In most
> cases, signed attributes are present.  When signed attributes are
> present, the message-digest attribute MUST be one of the
> attributes.  Eric is suggesting that the “identity” hash could be
> used with Ed25519 and Ed448 when there are no attributes to
> hash.  Using ED25519 as an example, we get:
> 
>    IF (signed attributes are absent)
>    THEN
> 	signedData.digestAlgorithms includes id-hashIdentity
>         signedData.signerInfo.digestAlgorithm = id-hashIdentity
>         signedData.signerInfo.signature = Ed25519(content)
>    ELSE
> 	signedData.digestAlgorithms includes id-sha512
>         signedData.signerInfo.digestAlgorithm = id-sha512
> 	signedData.signerInfo.signedAttrs includes message-digest =
> SHA512(content)
>         signedData.signerInfo.signature =
> Ed25519(DER(signedData.signerInfo.signedAttrs))
> 
> Do others think the use of an algorithm identifier for the “identity”
> hash is better?  The current document include id-sha512 as a warning
> that Ed25519 uses that hash algorithm internally.

I miss the benefit of that change. Given that the flag 'signed
attributes are absent' is sufficient to determine the action to be
done, adding the identity hash identifier, can only create confusion.
The confusion can be because now we have multiple additional states
which provide no additional information.

E.g. the following are simply invalid:
'signed attributes are absent' and digestAlgorithm != id-hashIdentity
'signed attributes are present' and digestAlgorithm = id-hashIdentity

I prefer the original approach due to its simplicity.

regards,
Nikos