[openpgp] Ed25519

Werner Koch <wk@gnupg.org> Thu, 14 November 2013 17:55 UTC

Return-Path: <wk@gnupg.org>
X-Original-To: openpgp@ietfa.amsl.com
Delivered-To: openpgp@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CBD0511E8164 for <openpgp@ietfa.amsl.com>; Thu, 14 Nov 2013 09:55:53 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.105
X-Spam-Level:
X-Spam-Status: No, score=-10.105 tagged_above=-999 required=5 tests=[AWL=0.126, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8, URI_HEX=0.368]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zrTS2DH1-Ku1 for <openpgp@ietfa.amsl.com>; Thu, 14 Nov 2013 09:55:46 -0800 (PST)
Received: from kerckhoffs.g10code.com (kerckhoffs.g10code.com [217.69.77.222]) by ietfa.amsl.com (Postfix) with ESMTP id 26E8911E8163 for <openpgp@ietf.org>; Thu, 14 Nov 2013 09:55:45 -0800 (PST)
Received: from uucp by kerckhoffs.g10code.com with local-rmail (Exim 4.80 #2 (Debian)) id 1Vh18n-0005wR-PQ for <openpgp@ietf.org>; Thu, 14 Nov 2013 18:55:41 +0100
Received: from wk by vigenere.g10code.de with local (Exim 4.80 #3 (Debian)) id 1Vh10Q-00030N-Hq for <openpgp@ietf.org>; Thu, 14 Nov 2013 18:47:02 +0100
From: Werner Koch <wk@gnupg.org>
To: openpgp@ietf.org
Organisation: g10 Code GmbH
X-message-flag: Mails containing HTML will not be read! Please send only plain text.
OpenPGP: id=1E42B367; url=finger:wk@g10code.com
Date: Thu, 14 Nov 2013 18:47:02 +0100
Message-ID: <87ppq2ub8p.fsf@vigenere.g10code.de>
User-Agent: Gnus/5.13 (Gnus v5.13)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Subject: [openpgp] Ed25519
X-BeenThere: openpgp@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "Ongoing discussion of OpenPGP issues." <openpgp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/openpgp>, <mailto:openpgp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/openpgp>
List-Post: <mailto:openpgp@ietf.org>
List-Help: <mailto:openpgp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/openpgp>, <mailto:openpgp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 14 Nov 2013 17:55:54 -0000

Hi,

a few weeks ago I already mentioned that I would like to implement
Ed25519 in GnuPG.  Meanwhile I did that but I am not sure whether we
really want this hack.

Ed25519 is based on Curve25519 but uses a different signature algorithm
than EdDSA.  That algorithm avoids a lot of pitfalls using plain ECDSA.
The paper [1] explains this in detail.  I implemented that by switching
to this algorithm for a certain OID.  It does not look right to do so.
Thus I wonder whether we better assign a new id for EdDSA.

I have not yet seen the specs for Curve3617 but I assume that it uses a
similar scheme for signing.  Thus Ed25519 and a signing algorithm for
Curve3617 may share the same algorithm id.  Or well, for an even more
compact key format we could also directly assign an algorithm id for
Ed25519.

A separate algorithm id would also allow to use the compressed key
format instead of packing it into the 0x04 uncompressed format as
specified by rfc-6637.

A problem I see in writing an I-D is that there is no formal
specification of Ed25519, just the paper.  I am not sure whether is
acceptable for an RFC.  The next free algorithm id would be 22.


Shalom-Salam,

   Werner


[1] See http://ed25519.cr.yp.to/
-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.