Subject: Re: [Curdle] Some work for the group

From: Daniel Migault <[email-masked]>
Date: Tue, 17 Jan 2017 16:14:10 -0500

Hi,

So it is not clear to me whether we have found consensus on that thread.

My understanding is that there is not a clear consensus that pre-hash
version of EdDSA MUST NOT be used by CA.

Would it help moving the document forward by:
    - 1) enabling CA to use these versions in Section 5 and,
    - 2) bring the discussion of pre-hash usage by CA in the Security
consideration section.

Yours,
Daniel

On Thu, Dec 15, 2016 at 11:33 AM, Phillip Hallam-Baker <
[email-masked]> wrote:

> It looks to me as if in effect the prehash vs pure issue is going to
> settle out into a situation where all signatures are pure signatures at the
> specification level with an additional hash being introduced in the
> packaging layer where bulk data is involved.
>
> I have implemented most of the popular packaging formats and most of my
> API calls internally turn out to be for a 'sign and digest' operation
> rather than Sign-this-digest. Most cases the bulk data is being put through
> a digest that is then put into some other structure for signature. There is
> almost always some sort of metadata you want in there in addition to the
> content.
>
> Another way to look at this is that Ed255x is a drop in replacement for
> RSA Signature that removes the restriction on the size of the input data to
> be signed but not the requirement for it to be buffered. Most packaging
> formats end up being a signature over a small chunk of static data which in
> the case of streamed content are virtually always reference to external
> data.
>
>
> _______________________________________________
> Curdle mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/curdle
>
>

---

From: Daniel Migault <[email-masked]>
Date: Tue, 24 Jan 2017 20:39:27 -0500

Hi,

As I have not seen any comments on that, should we consider that we have a
rough consensus ?
If you believe that is not the appropriate way to close this thread, please
raise your opinion by the end of the week.

Yours,
Daniel

On Tue, Jan 17, 2017 at 4:14 PM, Daniel Migault <[email-masked]
> wrote:

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Fri, 27 Jan 2017 12:20:34 +0100

On Tue, 2017-01-24 at 20:39 -0500, Daniel Migault wrote:
> Hi, 
> 
> As I have not seen any comments on that, should we consider that we
> have a rough consensus ?
> If you believe that is not the appropriate way to close this thread,
> please raise your opinion by the end of the week. 

I'm certainly fine with that.

regards,
Nikos

---

From: Brian Smith <[email-masked]>
Date: Sat, 28 Jan 2017 19:40:20 -1000

>     - 2) bring the discussion of pre-hash usage by CA in the Security

I disagree that there's any kind of consensus to make that change.

Besides the security issue, my understanding is that using the prehash
variant would result in lots of interop failures as, AFAICT, there
isn't going to be much support for it in verification libraries.

Is there a list of implementations for this draft?

Cheers,
Brian

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Sun, 29 Jan 2017 11:32:30 +0100

> isn't going to be much support for it in verification libraries.

Isn't that orthogonal to the question? If the prehash version is going
to cause interop issues is not affected by the text quoted above. Your
comment is on whether including the prehashed version at all.

regards,
Nikos