[openpgp] Re: pure vs. pre-hash in FIPS 204 and 205

[Daniel Huigens <[e-mail]>]

Hi Akhil,

On Wednesday, August 28th, 2024 at 02:46, Akhil CM wrote:

> I think this is the part where the common misunderstanding is. It is more accurate to to say thatpre-hash version of ML-DSAdoes a "single hashing" step (rather than calling it "extra") before passing the message to the signing algorithm used by the "pure" variant.

Well, even the pure version of ML-DSA has a hashing step internally (see section 6.2 of FIPS 204). So I think saying that HashML-DSA does an extra hashing step (compared to the pure version) is accurate :) But yes, of course there is not an extra hashing step compared to using HashML-DSA and removing the hashing step at the application level (or, as Falko proposed, passing the hash from the application level and asking the cryptography library to compute HashML-DSA without doing the extra hashing step that's normally there, by using the already-computed hash digest instead).

> In the same section 5.4, as Daniel quoted in a reply and I re-quoted above, they talk about the hashing of the message at the application level and continues to add that in such cases the application level hash may be signed directly. So, from the context it can be considered that the following are equivalent or similar (not to be confused with same or identical):
>
> - Application level hashing + signing
> - pre-hash variant signing

Yes, indeed. However, even though they are roughly equivalent, both FIPS 204 and RFC 8032 seem to recommend using the first one where possible.

> In my opinion, the best way to go about this so as to provide minimal confusion between various literatures would be to do one of the following:
>
> - Explicity provide three categories: "pure", "pre-hash" and "hash at application level" + "pure"

I'm fine with that, although I think nobody has proposed the first option (pure signing without hashing).

> - Mention "hash at application level" + "pure" as an alternate to "pre-hash" once, as done in FIPS 204, and then continue to use the terminology "pre-hash" whenever a hashed message is passed to the signing algorithm used by the "pure" version

I don't think that would clarify things but rather confuse them, as technically speaking, "hash at application level + pure" and "pre-hash" are still different and produce a different result (even though they are equivalent in security for the purposes of OpenPGP). So for clarity I think it's better to spell it out as you did (or shortened to "hash + pure ML-DSA" vs "HashML-DSA"), at least until a decision has been made :)

Best,
Daniel