Subject: [Cfrg] Padding out SHAKE128 for ECDSA 512

From: Jim Schaad <[email-masked]>
Date: Sat, 4 Aug 2018 08:25:17 -0700

In the process of reviewing the documents in the LAMPS working group for
dealing with SHAKE as a hash algorithm for RSA-PSS and ECDSA I ended up with
a question about using SHAKE128 for ECDSA w/ 512 bit keys.

Are there any reasons to extend the hash value created by SHAKE128 to |q|-1
(avoid the modulo operation) rather than leaving all of the upper bits as
zeros?  I know that one of the reasons that RSA-PSS has a security proof is
that all of the bits that are encrypted are set and not left as zeros.  Is
there a similar argument that can be made here?

Jim

---

From: Jim Schaad <[email-masked]>
Date: Sat, 4 Aug 2018 11:08:08 -0700

I should add - Yes I know that I get zero additional bits of security from
the signature operation, it is still limited by using the SHAKE128 function.

> -----Original Message-----
> From: Cfrg <[email-masked]> On Behalf Of Jim Schaad
> Sent: Saturday, August 4, 2018 8:25 AM
> To: [email-masked]
> Subject: [Cfrg] Padding out SHAKE128 for ECDSA 512
> 
zeros?
> I know that one of the reasons that RSA-PSS has a security proof is that
all of
> the bits that are encrypted are set and not left as zeros.  Is there a
similar
> argument that can be made here?
> 
> Jim
> 
> 
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg

---

From: Tony Arcieri <[email-masked]>
Date: Sat, 4 Aug 2018 16:02:24 -0600

Is there a particular elliptic curve you're thinking of with a 512-bit
modulus? (as opposed to a 521-bit modulus)

-- 
Tony Arcieri

---

From: Jim Schaad <[email-masked]>
Date: Sat, 4 Aug 2018 15:15:37 -0700

No,  I meant a 521-bit modulus my memory has never gotten that number correctly attached as 512 is the security number that I always reference the curve to.

From: Tony Arcieri <[email-masked]> 
Sent: Saturday, August 4, 2018 3:02 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [Cfrg] Padding out SHAKE128 for ECDSA 512

Is there a particular elliptic curve you're thinking of with a 512-bit modulus? (as opposed to a 521-bit modulus)

On Sat, Aug 4, 2018 at 9:25 AM Jim Schaad <[email-masked] <mailto:[email-masked]> > wrote:

Jim

_______________________________________________
Cfrg mailing list
[email-masked] <mailto:[email-masked]> 
https://www.irtf.org/mailman/listinfo/cfrg

-- 

Tony Arcieri