Re: [Curdle] AD Review: draft-ietf-curdle-cms-eddsa-signatures-05.txt

[Russ Housley <[e-mail]>]

> 
>> TECHNICAL
>> S 3.1 and 3.2.
>> - Is there some reason to not prescribe exactly one form here?
>>  I.e., require id-sha512 (etc.) or require it not be there?
>> 
>> - Also, TLS has converged on talking about an "identity" hash
>>  for the PureEd forms. Was this discussed and rejected?
> 
> CMS supports signatures with and without signed attributes.  In most cases, signed attributes are present.  When signed attributes are present, the message-digest attribute MUST be one of the attributes.  Eric is suggesting that the “identity” hash could be used with Ed25519 and Ed448 when there are no attributes to hash.  Using ED25519 as an example, we get:
> 
>   IF (signed attributes are absent)
>   THEN
> 	signedData.digestAlgorithms includes id-hashIdentity
>        signedData.signerInfo.digestAlgorithm = id-hashIdentity
>        signedData.signerInfo.signature = Ed25519(content)
>   ELSE
> 	signedData.digestAlgorithms includes id-sha512
>        signedData.signerInfo.digestAlgorithm = id-sha512
> 	signedData.signerInfo.signedAttrs includes message-digest = SHA512(content)
>        signedData.signerInfo.signature = Ed25519(DER(signedData.signerInfo.signedAttrs))
> 
> Do others think the use of an algorithm identifier for the “identity” hash is better?  The current document include id-sha512 as a warning that Ed25519 uses that hash algorithm internally.

I would like to hear from others about this suggestion from Eric Rescorla’s review.  Jim pointed out one possible downside.  Others have been silent.

Russ