[TLS] Schnorr Signatures

[Nigel Smart <[e-mail]>]

Hi

[First post to list so please ignore any breaking of etiquette etc]

As we are moving to TLS 1.3 I wondered why not include EC-Schnorr
signatures in the standard as a possible addition to EC-DSA for the signing.
Some notes...

i)   Schnorr is faster than EC-DSA
ii)  Patent has expired
iii) Shorter signatures
iv) Has a proper proof of security and not "tainted" by NSA design
            - Unlike EC-DSA in both instances.
  v) Protects against hash collisions. i.e. any hash function break 
involving
      collisions does not provide an attack on the signature scheme.
vi) Allows various other tricks to be done more easily
vii) Already standardized in ISO. The ISO standard just gives Schnorr as a
       tweak on the EC-DSA signature. So there is not much work to do.
viii) Can use the same EC-DSA certs as EC-DSA signing. All that changes
        is how the signing equation is generated and verified.

Cheers

Nigel