Subject: [Cfrg] Review of draft-irtf-cfrg-eddsa-8

From: Jim Schaad <[email-masked]>
Date: Fri, 19 Aug 2016 14:16:07 -0700

This draft satisfies all of my issues.  From that point of view I think it
is ready to progress.

The following at things that might be clarifications and might not.  I would
request that you look at them, but none of them are of the level that I feel
they need to be fixed.

Section 3.3 - paragraph 1 - The text here is slightly misleading.  It was
correct in the past for EdDSA25519 and EdDSA25519ph, but it is not quite
correct now.  Given that much clearer instructions exist in later sections I
don't think this is a problem.

I don't know if this needs to be dealt with in the constant time
verification or not.  Can I short circuit after doing the checks for
validity of S and the public key without doing the math to check the
signature value and not leak any significant information.

I will look at doing validation of the examples sometime this weekend.

Jim

---

From: Ilari Liusvaara <[email-masked]>
Date: Sat, 20 Aug 2016 10:28:20 +0300

On Fri, Aug 19, 2016 at 02:16:07PM -0700, Jim Schaad wrote:

I don't know about that EdDSA intro section. I find it hard to
read too.

> signature value and not leak any significant information.

Well, all inputs for verification are usually public, so verification
usually does not need to be constant-time.

(There might be some bad standards that need constant-time
verification, but those are very rare and quite nasty).

-Ilari

---

From: Jim Schaad <[email-masked]>
Date: Sat, 20 Aug 2016 15:07:34 -0700

I have validated the following:

1.  All of the examples in the draft validate using the python code
supplied.
2.  All of the examples in the draft validate using my implementation.

Jim

> -----Original Message-----
> From: Cfrg [mailto:[email-masked]] On Behalf Of Jim Schaad
> Sent: Friday, August 19, 2016 2:16 PM
> To: [email-masked]; [email-masked]
> Subject: [Cfrg] Review of draft-irtf-cfrg-eddsa-8
> 
is ready to
> progress.
> request that you look at them, but none of them are of the level that I
feel they
> need to be fixed.
correct in
> the past for EdDSA25519 and EdDSA25519ph, but it is not quite correct now.
> Given that much clearer instructions exist in later sections I don't think
this is a
> problem.
verification or
> not.  Can I short circuit after doing the checks for validity of S and the
public key
> without doing the math to check the signature value and not leak any
significant
> information.
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg