Subject: [Curdle] Pure/Hash issue with draft-ietf-curdle-cms-eddsa-signatures-08

From: Conrado P. L. Gouvêa <[email-masked]>
Date: Mon, 9 Apr 2018 16:00:25 -0300

Hi,

I have a question about draft-ietf-curdle-cms-eddsa-signatures-08.
(I'm not sure if this is the right place to ask...)

Quoting the draft:

"In most situations the CMS SignedData includes signed attributes,
including the message digest of the content.  Since HashEdDSA offers
no benefit when signed attributes are present, only PureEdDSA is used
with the CMS."
"The EdDSA specification [RFC8032] includes the following warning. It
deserves highlighting, especially when signed-data is used without
signed attributes and the content to be signed might be quite large:
PureEdDSA requires two passes over the input. (...)"

It's not clear, but this seems to imply that when signed-data is used
*with* signed attributes, then two-pass is not an issue.
However, I fail to see why that's the case. Doesn't the two-pass
requirement always apply? AFAIK the whole message is signed in both
cases.

Cheers,

Conrado Gouvea

---

From: Jim Schaad <[email-masked]>
Date: Wed, 11 Apr 2018 10:12:48 -0700

If you sign w/ attributes, then the main message is hashed and that hash is
part of the signed attributes.  This means that when you sign w/ attributes
only the signed attributes are processed twice by the signature algorithm.
This is a small sized set of bytes so doing two passes is not a huge
problem.  It is more of an issue when you sign w/o attributes as in that
case the entire message body is passed to the signature algorithm.

> -----Original Message-----
> From: Curdle <[email-masked]> On Behalf Of Conrado P. L. Gouvêa
> Sent: Monday, April 9, 2018 12:00 PM
> To: [email-masked]
> Subject: [Curdle] Pure/Hash issue with draft-ietf-curdle-cms-eddsa-
> signatures-08
> 
> Hi,
> 
including
> the message digest of the content.  Since HashEdDSA offers no benefit when
> signed attributes are present, only PureEdDSA is used with the CMS."
> deserves highlighting, especially when signed-data is used without signed
> attributes and the content to be signed might be quite large:
requirement
> always apply? AFAIK the whole message is signed in both cases.
> 
> Cheers,
> 
> Conrado Gouvea
> 
> _______________________________________________
> Curdle mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/curdle

---

From: Conrado P. L. Gouvêa <[email-masked]>
Date: Wed, 11 Apr 2018 16:09:31 -0300

> case the entire message body is passed to the signature algorithm.

I think I got it, I was confused with RFC 5652:

"The message digest calculation process computes a message digest on
   either the content being signed or the content together with the
   signed attributes.  In either case, the initial input to the message
   digest calculation process is the "value" of the encapsulated content
   being signed.  Specifically, the initial input is the
   encapContentInfo eContent OCTET STRING to which the signing process
   is applied."

this led me to believe that either H(M) or H(M || SignedAttributes) was signed.
But it's actually either H(M) or H(SignedAttributes), where
SignedAttributes contain H(M), right?
Which is made clearer in the next paragraph:

"When the field is absent,
   the result is just the message digest of the content as described
   above.  When the field is present, however, the result is the message
   digest of the complete DER encoding of the SignedAttrs value
   contained in the signedAttrs field."

So yes, it makes sense to use PureEdDSA.

Sorry for the noise!

Conrado