Subject: Re: [Cfrg] [TLS] Additional Elliptic Curves (Curve25519 etc) for TLS ECDH key agreement

From: Peter Gutmann <[email-masked]>
Date: Mon, 13 Jan 2014 01:08:41 +0000

Alyssa Rowan <[email-masked]> writes:

>EdDSA uses a hash to generate deterministic secret random exponents, to avoid
>eating entropy when signing (like ECDSA does in its natural habitat). That
>will need to be a big enough hash to cover the size we need: 512 bits covers
>2^255 - 19, but to cover Curve3617 or E521, we're going to need a bigger boat.

That assumes you need a single application of a hash function to do the job,
which as several people have pointed out is going to bite you at some point
when you run out of appropriately-sized hash functions.  Why not use HKDF, RFC
5869, which works with any hash function you like?

Peter.

---

From: Jon Callas <[email-masked]>
Date: Mon, 13 Jan 2014 00:08:14 -0800

> 5869, which works with any hash function you like?

Or use a hash function that has variable output, like Skein or SHA-512/z or others.

	Jon