Subject: [Cfrg] RGLC on draft-irtf-cfrg-eddsa-02.txt

From: Alexey Melnikov <[email-masked]>
Date: Mon, 25 Jan 2016 18:36:47 +0000

Dear CFRG participants,

This message starts 2 weeks RGLC on draft-irtf-cfrg-eddsa-02 
("Edwards-curve Digital Signature Algorithm (EdDSA)"), which will end on 
February 8th. Please respond with your reviews to the mailing list or 
directly to chairs and editors. If you reviewed the document and found 
it to be ready for publication, please let the chairs know as well.

Best Regards,
Kenny and Alexey

---

From: Watson Ladd <[email-masked]>
Date: Mon, 25 Jan 2016 11:19:36 -0800

Why are there two different addition formulas used? The answer is that
one is twisted and the other not, but it's not immediately clear from
the draft that there is a distinction.

With the publication of the curves draft the references need to be
updated. Also the source for the fast formula in the second is the one
the EFD cites, plus automatic optimizations in the EFD, so the
publication concerning the EFD needs to be cited along with the
original source.

On Mon, Jan 25, 2016 at 10:36 AM, Alexey Melnikov
<[email-masked]> wrote:
> Dear CFRG participants,
>
> This message starts 2 weeks RGLC on draft-irtf-cfrg-eddsa-02 ("Edwards-curve
> Digital Signature Algorithm (EdDSA)"), which will end on February 8th.
> Please respond with your reviews to the mailing list or directly to chairs
> and editors. If you reviewed the document and found it to be ready for
> publication, please let the chairs know as well.
>
> Best Regards,
> Kenny and Alexey
>
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg

-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.

---

From: Ilari Liusvaara <[email-masked]>
Date: Sat, 30 Jan 2016 21:34:33 +0200

> Digital Signature Algorithm (EdDSA)"), which will end on February 8th.

On Curdle list, somebody was apparently confused about algorithm
choices and requested some guidance to be included.

Here is initial (quite biased) attempt (probably also full of
bad editing):

Choice of signature primitive
=============================

The Ed25519 and Ed25519ph have nominal strength of 128 bits,
whereas Ed448 and Ed448ph have strength of 224. While the lower
strength is sufficient for the forseeable future, the higher level
brings some defense against possible future cryptographic advances.
Both are demolished by quantum computers just about the same.

The Ed25519ph and Ed448ph variants are prehashed. This is mainly
useful for interoperation with legacy APIs, since in most of the
cases, either the amount of data signed is not large, or the protocol
is in position to do digesting in ways better than just prehashing (e.g.
tree hashing or splitting the data). The prehashing also makes the
functions greatly more vulernable to weaknesses in hash functions
used. These variants SHOULD NOT be used.

On implementation front, Ed25519 is widely implemented, and has
many high-quality implementations. The others have much worse
support.

As summary, if high 128-bit security level is enough, use of
Ed25519 is RECOMMENDED, otherwise Ed448 is RECOMMENDED.

-Ilari

---

From: Ilari Liusvaara <[email-masked]>
Date: Sun, 31 Jan 2016 15:08:05 +0200

> the draft that there is a distinction.

Added the preconditions the formulas have (which are different).
 
> updated.

Updated.

> Also the source for the fast formula in the second is the one

Can you give a proper reference?

-Ilari

---

From: Watson Ladd <[email-masked]>
Date: Sun, 31 Jan 2016 11:56:05 -0800

> Can you give a proper reference?

Daniel J. Bernstein, Peter Birkner, Marc Joye, Tanja Lange, Christiane
Peters. "Twisted Edwards curves." Pages 389–405 in Progress in
cryptology—AFRICACRYPT 2008, first international conference on
cryptology in Africa, Casablanca, Morocco, June 11–14, 2008,
proceedings, edited by Serge Vaudenay. Lecture Notes in Computer
Science 5023, Springer, 2008. ISBN 978-3-540-68159-5.