Re: [Dcrup] I-D draft-ietf-dcrup-dkim-crypto-06

["John Levine" <[e-mail]>]

In article <[e-mail]> you write:
>On 13/09/17 18:41, John R Levine wrote:
>> I have sent in a new draft which is intended to take into account all of
>> the comments I've seen.
>
>Section 4 says to use the Pure variant of Ed25519, which section 4
>of rfc 8032 appears to describe as (my paraphrase) sign only; not
>hashing the data handed to it.  What we hand to it is already a
>hash, using sha256.
>
>Do I have that right?

Yes.

>The existing interfaces in both GnuTLS and OpenSSL appear to
>be aiming towards a Hash version of Ed25519, if I read them right -
>and they don't say explicitly what the hash-function is.

We know, see previous discussion of this exact topic.  The existing
RSA DKIM signatures already do a hash of the canonicalized text and it
is operationally a lot easier to pass the same hash to EC crypto
rather than invent a different canonicalization scheme just to move
the hash to the other side of the call to the crypto library.

>Are we expecting these libraries to enhance their APIs?

I haven't looked in detail at the APIs for Ed25519 crypto, but naively
assumed that if the spec says there's a pure version that doesn't hash
its input, the libraries would implement it.

R's,
John