Re: [Curdle] Review of draft-ietf-curdle-cms-eddsa-signatures-03

[Russ Housley <[e-mail]>]

Ilari:

>> 
>>> Section 3.1 - I would like to have a brief discussion on the integer value
>>> that is being used with the id-shake256-len OID when it is being used as a
>>> digest algorithm.  The value of 512 means that the signature security is
>>> going to be the same as is currently setup for Ed25519.  To have the same
>>> dynamic as Ed25519 does, this should be 448*2 so that after birthday attacks
>>> the same size of value would be provided.
>> 
>> RFC 8032 uses SHAKE256(x, 114) every place that SHAKE256 is used.  Reading
>> a bit more carefully, I see that the output is 114 octets or 912 bits.
> 
> Nitpick: Only true of no-prehash versions. The prehash itself uses
> SHAKE256 with 512-bit input.
> 
>> I suggest that we align with these values.  That is:
>> 
>>   When signing with Ed448, the message digest
>>   algorithm MUST be SHAKE256 [FIPS202] with a 912-bit output value.
>> 
>> and
>> 
>>   When using the id-shake256-len algorithm identifier, the parameters
>>   MUST be present, and the parameter MUST contain 912, encoded as a
>>   positive integer value.
> 
> The hash algorithm is internal detail of EdDSA, unless you are talking
> about doing prehashing at "application" level (which certainly a valid
> approach).
> 
> On security of using just 512-bit hash there, SHAKE256 does not promise
> resistance above 2^256 for any attack, which it reaches at 512-bit output
> (collision resistance being the limiting factor). And the security
> level of the curve certainly isn't above 2^256.
> 
> So 512-bit hash should be entierely adequate for application-level
> prehash (just don't use SHA3-512, it is hilariously slow).

CMS supports signatures with and without signed attributes.  In most cases, signed attributes are present.  When signed attributes are present, the message-digest attribute MUST be one of the attributes.  It was signed to work like this:

    IF (signed attributes are absent)
    THEN md = Hash(content)
    ELSE message-digest attribute = Hash(content);
         md = Hash(DER(SignedAttributes))

    Sign(md)

So, I think you are saying that a 512-bit output was sufficient, which is what was present in the earlier text:

   When using the id-shake256-len algorithm identifier, the parameters
   MUST be present, and the parameter MUST contain 512, encoded as a
   positive integer value.

Russ