Subject: Re: [Cfrg] EdDSA signer's PRF conservative enough, or as possible?

From: "D. J. Bernstein" <[email-masked]>
Date: 28 Feb 2016 04:40:57 -0000

Dan Brown writes, in the context of HMAC vs. AMAC:
> [DB] Yes, "provable security" is nice too, especially for deciding
> between new schemes.

Just to properly close this discussion, the following paper states
proofs of two models of security for AMAC (new name for the
prefixed-SHA-512-mod-l function used inside Ed25519):

   https://eprint.iacr.org/2016/142.pdf

This will appear at Eurocrypt 2016.

---Dan