Re: [pkix] Edwards/DJB curves - New PKI(X) work?

[Michael StJohns <[e-mail]>]

At 04:55 AM 8/18/2014, Johannes Merkle wrote:




>> For PKIX at least for signatures you need:
>>
>> 1) An ASN1 public key representation (and the appropriate OID).  Since there's only one DJB curve(?is that correct or
>are two needed for signature and ecdh?), you could get away with just a new OID for AlgorithmIdentifier.algorithm.
>> 2) The format of the bitstring that represents a signature
>> 3) One or more signature algorithms (e.g. SHA256withX, SomeOtherHashWithX, etc) and their OIDs.
>>
>
>I disagree with 2) though: In all Schnorr-like signatures, the signature consists of two integers, not (EC) group
>elements. Thus, the EC point semantic has no influence on the signature encoding. It only has impact on the signature
>generation and verification algorithms (e.g. defined in ANSI X9.62 and FIPS 186-4), but these are out of the scope of PKIX.


Sort of.  The representation for PKIX EC signatures using X9.63/FIPS186-3/SECG1 is 

BIT STRING encapsulating {
    SEQUENCE {
           INTEGER r,
         INTEGER s
     }
}

 - I assume that's what you mean for Schnorr signatures?

In DJB's ED25519, the signature is actually a single integer, and tucked away in his paper is the notation that the representation of that integer is little endian.

So you could use either of 

BIT STRING encapsulatiing {
    INTEGER s
}

or 
BIT STRING encapsulating {
    OCTET STRING SIZE (32) s   ; little endian representation of a 255 bit integer
}

or even

BIT STRING SIZE(255)

or 

BIT STRING


At this point I would assume new key type OID's, *maybe*  new curve OIDs if the curve  isn't implied by the key type, and new signature type OIDs and representations. 

Mike