Re: [Curdle] Pure/Hash issue with draft-ietf-curdle-cms-eddsa-signatures-08

If you sign w/ attributes, then the main message is hashed and that hash is
part of the signed attributes.  This means that when you sign w/ attributes
only the signed attributes are processed twice by the signature algorithm.
This is a small sized set of bytes so doing two passes is not a huge
problem.  It is more of an issue when you sign w/o attributes as in that
case the entire message body is passed to the signature algorithm.

> -----Original Message-----
> From: Curdle <curdle-bounces@ietf.org> On Behalf Of Conrado P. L. Gouvêa
> Sent: Monday, April 9, 2018 12:00 PM
> To: curdle@ietf.org
> Subject: [Curdle] Pure/Hash issue with draft-ietf-curdle-cms-eddsa-
> signatures-08
> 
> Hi,
> 
> I have a question about draft-ietf-curdle-cms-eddsa-signatures-08.
> (I'm not sure if this is the right place to ask...)
> 
> Quoting the draft:
> 
> "In most situations the CMS SignedData includes signed attributes,
including
> the message digest of the content.  Since HashEdDSA offers no benefit when
> signed attributes are present, only PureEdDSA is used with the CMS."
> "The EdDSA specification [RFC8032] includes the following warning. It
> deserves highlighting, especially when signed-data is used without signed
> attributes and the content to be signed might be quite large:
> PureEdDSA requires two passes over the input. (...)"
> 
> It's not clear, but this seems to imply that when signed-data is used
> *with* signed attributes, then two-pass is not an issue.
> However, I fail to see why that's the case. Doesn't the two-pass
requirement
> always apply? AFAIK the whole message is signed in both cases.
> 
> Cheers,
> 
> Conrado Gouvea
> 
> _______________________________________________
> Curdle mailing list
> Curdle@ietf.org
> https://www.ietf.org/mailman/listinfo/curdle