Re: [pkix] PKCS #8? Re: Updated EdDSA/Ed25519 PKIX document

[Simon Josefsson <[e-mail]>]

Anders Rundgren <[e-mail]> writes:

>> Right now we are re-using the
>> EdDSA public key OID for the private key OID too.
>
> I think this should be harmonized with JOSE who essentially have the following
> alternatives for describing public keys:
>
> jwk:
>   {
>     "kty": "EC",
>     "crv": "ED25519",
>     "x": "8dymopMICY76wfnqdpX0JDpCRYke0-Jp1p7lKPQIIRg",
>   }
>
> The above departs from the current JWK standard which requires an "y" as well
> making the the following approach a viable alternative:
>
> jwk:
>  {
>   "kty": "ED",
>   "crv": "ED25519",
>   "x": "8dymopMICY76wfnqdpX0JDpCRYke0-Jp1p7lKPQIIRg",
> }
>
> From what I can deduct, this latter scheme is more in line with your PKIX
> SPKI solution.

No, https://tools.ietf.org/html/draft-josefsson-pkix-eddsa-03 only
encodes the x parameter.  So this appears consistent.

> This would also be great for Android and Java.  In fact the only solution
> I have found for Java indeed defines a new provider key class:
> https://github.com/str4d/ed25519-java/blob/master/test/net/i2p/crypto/eddsa/EdDSAEngineTest.java#L36
>
> Of course this choice won't shatter the earth but having different solutions
> for PKIX and JOSE would IMO be quite unfortunate.

I don't believe there is sufficient overlap in implementation to matter
in practice, however the fundamental principles should be the same for
both protocols, so it would indeed be surprising if they ended up
differently.

/Simon

> Anders
>
>
>>
>> One alternative to the approach we've taken is to re-use the RFC 5915 EC
>> private key format.  Then everything is covered by the combination of
>> RFC 5915 and the NamedCurve registration in:
>> https://tools.ietf.org/html/draft-josefsson-pkix-newcurves-01
>>
>> Does anyone have thoughts on which approach to use?
>>
>> Thanks,
>> /Simon
>>
>>>
>>> Anders
>>>
>>>>
>>>> I have pushed out a new version of the document describing EdDSA public
>>>> keys, signatures and certificates for PKIX.  The change in -03 include
>>>> the addition of the prehash mode, test vectors generated by GnuTLS, and
>>>> a section recommending certain human readable names.
>>>>
>>>> https://tools.ietf.org/html/draft-josefsson-pkix-eddsa-03
>>>>
>>>> I've started a thread to discuss whether it is wortwhile to be able to
>>>> use the same Ed25519 key for both PureEdDSA mode and HashEdDSA signing,
>>>> and I'd appreciate feedback on whether people are interested in this and
>>>> generally if it is a good idea or not.  The complexity involved make me
>>>> shy away a bit from it, but it is fun to consider.  The thread is here:
>>>> https://moderncrypto.org/mail-archive/curves/2015/000630.html
>>>>
>>>> /Simon
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> pkix mailing list
>>>> [e-mail]
>>>> https://www.ietf.org/mailman/listinfo/pkix
>>>>
>>>
>>
>
> _______________________________________________
> pkix mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/pkix
>