Subject: [Curdle] Review of draft-ietf-curdle-cms-eddsa-signatures-03

From: Jim Schaad <[email-masked]>
Date: Wed, 29 Mar 2017 10:50:09 -0500

Section 3.1 - I would like to have a brief discussion on the integer value
that is being used with the id-shake256-len OID when it is being used as a
digest algorithm.  The value of 512 means that the signature security is
going to be the same as is currently setup for Ed25519.  To have the same
dynamic as Ed25519 does, this should be 448*2 so that after birthday attacks
the same size of value would be provided.

Section 4 - I thing that it should also be highlighted that this is a
greater problem for when using the Signed-data without signed attributes as
the value signed is more constrained in the other case.

Jim