[openpgp] Re: pure vs. pre-hash in FIPS 204 and 205

[Phillip Hallam-Baker <[e-mail]>]

The Monty Hall Problem provides a very useful illustration of how the
framing of the problem can misdirect.

In the Monty Hall problem, the contestant is given a choice of three doors,
they can pick one door or they can pick two doors, their choice, should the
contestant pick one door or two?

Presented in that framing, the answer is obviously 'two doors'. But that is
not how the problem is presented. What they are told instead is they pick
one door, the presenter then removes one of the remaining doors that does
not have a prize and asks if they want to switch. That choice has
absolutely the identical probabilities as one or two doors. But it can take
hours sometimes to get someone to see that is the case.

If we look at this problem from the framing of 'design the best signature
system' then the prehash is a part of our signature concern and we think of
the two as being equally part of our bailiwick.

But that is the wrong approach. The correct framing is to consider a
cryptographic application with interfaces between modules that address
separate concerns and in that framing, the digest function belongs to a
separate module to the signature because that is the way we have designed
those interfaces.

If we don't respect the framing of the application developer, we risk
overlooking the fact that the interface between the two modules is NOT the
digest value, it is the tuple of the digest value and the digest algorithm.


And the deeper lesson of Monty Hall is that the framing of the problem we
are given by circumstances is often the wrong one for addressing it and the
real task of solving the problem is to discover the right frame.


On Thu, Aug 29, 2024 at 2:27 PM Andrew Gallagher <andrewg=
[e-mail]> wrote:

> On 29 Aug 2024, at 18:57, Daniel Huigens <d.huigens=
> [e-mail]> wrote:
>
>
> Hi Andrew,
>
> On Thursday, August 29th, 2024 at 19:40, Andrew Gallagher <andrewg=
> [e-mail]> wrote:
>
>
> I believe at least some of the confusion arises from the spurious “not” in
> the last sentence above, which seems to me to be a typo. IMO it should read
> “if the content IS hashed at the application level, the pre-hash version of
> ML-DSA signing may be used.”
>
>
> No, I'm pretty sure the original is correct. The pre-hash version adds an
> extra hash compared to the pure version. Therefore, if the application does
> *not* hash the data, *and* a single-pass (e.g. streaming) API is
> required, then HashML-DSA (the pre-hash version) can be used.
>
>
> Ugh, yes you are correct. The text uses the passive voice extensively,
> which makes it very difficult to keep track of who or what is doing the
> hashing at each particular stage. I had to read it several times… :-( Sorry.
>
> A
> _______________________________________________
> openpgp mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>