Subject: [Cfrg] ECDSA_CFRG: age of suffix

From: Dan Brown <[email-masked]>
Date: Wed, 22 Jul 2015 14:37:54 +0000

Hi CFRG,

In June 2008, I proposed one of the features of ECDSA_CFRG.  Appendix A,
equation (6) of the my IACR eprint "One-Up Problem of (EC)DSA"
(http://eprint.iacr.org/2008/286) describes amending ECDSA by including in
the hash input, as a suffix to the message, the bit-representation of the
ECDSA small r (not to be confused the EdDSA secret small r).  ECDSA_CFRG
differs slightly in this feature by inclusion of the full R, not small r =
f(R), as well as having various other features.  Earlier publications of
this feature would not surprise me, I will have a look.

The report's appendix also briefly discusses the pros (precomputation
without prehashing) and cons (hash collision extension) of using suffix
instead of prefix. (The 2008 report does not seem to mention use of a
wide-pipe hash.)

Side note: this 2008 IACR eprint also proves the Slide 17 (which I almost
skipped verbally) theorem in my CFRG presentation of today.

In my CFRG presentation from today, I mentioned aegis = age * eyes, as one
type of security, so I might as well follow through by trying to apply the
metric to this feature.   Because this was work was un-refereed, and because
I also forgot about it, I'll score it with a half an eye, yielding an aegis
of about 3.5 year-eyes for this feature of ECDSA_CFRG.  Other publication
(especially refereed and cited) might increase the feature's aegis.

Best regards, 

Daniel Brown

Research In Motion Limited