[IPsec] draft-ietf-ipsecme-eddsa-01 pre-hash SHOULD NOT or MUST NOT

[Tero Kivinen <[e-mail]>]

Now the pre-hash algorithms are SHOULD NOT:

   The pre-hashed versions of Ed25519 and Ed448 (Ed25519ph and Ed448ph
   respectively) SHOULD NOT be used in IKE.

I think we could say MUST NOT be used.

I.e, say that pre-hash versions MUST NOT be used, and that Ed25519 and
Ed448 MUST be used with "Identity" hash identifier, and none of the
other currently defined signature algorithms MUST NOT use "Identity"
hash... 

The following part of the security considerations might also need
updating: 

	       On the other hand there is
   no good reason to pre-hash the inputs where the signature algorithm
   either does not require it or performs a hash internally.

This sentence would indicate that if the RSA key is large enough so we
can actually sign the full data without pre-hashing, that would be
something we would prefer. I do not think we actually want to allow
that. We should say that Identity hash identifier MUST only be used
when using signature algorithms specifically supporting it.

   	       	   	      	 	    For this
   reason implementations SHOULD have the "Identity" value in the
   SIGNATURE_HASH_ALGORITHMS notification when they support EdDSA.
   Implementations SHOULD NOT have other hash algorithms in the
   notification if all signature algorithms have this property.

If implementation supports EdDSA then it is policy decision whether it
wants to use it, and wheter it wants ot include "Identity" as one of
the hash algorithms. 
-- 
[e-mail]