Re: [pkix] Edwards/DJB curves - New PKI(X) work?

[Erwann Abalea <[e-mail]>]

2014-08-18 20:02 GMT+02:00 Michael StJohns <[e-mail]>:

> At 04:55 AM 8/18/2014, Johannes Merkle wrote:
>
> >> For PKIX at least for signatures you need:
> >>
> >> 1) An ASN1 public key representation (and the appropriate OID).  Since
> there's only one DJB curve(?is that correct or
> >are two needed for signature and ecdh?), you could get away with just a
> new OID for AlgorithmIdentifier.algorithm.
> >> 2) The format of the bitstring that represents a signature
> >> 3) One or more signature algorithms (e.g. SHA256withX,
> SomeOtherHashWithX, etc) and their OIDs.
> >>
> >
> >I disagree with 2) though: In all Schnorr-like signatures, the signature
> consists of two integers, not (EC) group
> >elements. Thus, the EC point semantic has no influence on the signature
> encoding. It only has impact on the signature
> >generation and verification algorithms (e.g. defined in ANSI X9.62 and
> FIPS 186-4), but these are out of the scope of PKIX.
>
>
> Sort of.  The representation for PKIX EC signatures using
> X9.63/FIPS186-3/SECG1 is
>
> BIT STRING encapsulating {
>     SEQUENCE {
>            INTEGER r,
>          INTEGER s
>      }
> }
>
>  - I assume that's what you mean for Schnorr signatures?
>
> In DJB's ED25519, the signature is actually a single integer, and tucked
> away in his paper is the notation that the representation of that integer
> is little endian.
>

Even in Ed25519 the signature consists of two 256bits integers. Little/big
endian representation doesn't care here.
R is a compressed version of a point (concatenation of y and lsb of x).
S is the standard S.

-- 
Erwann.