Subject: [lamps] Question about RFC8692 (SHAKE with RSA-PSS and ECDSA)

From: Ilari Liusvaara <[email-masked]>
Date: Wed, 9 Dec 2020 16:24:12 +0200

I am trying to implement RFC 8692, and hit a part I do not understand.

Specifically, the following part of section 4.2 (Public Keys):

> Conforming CA implementations MUST specify the X.509 public key
> algorithm explicitly by using the OIDs specified in Section 3 when
> encoding ECDSA with SHAKE public keys in certificates and CRLs.
> Conforming client implementations that process ECDSA with SHAKE
> public keys when processing certificates and CRLs MUST recognize the
> corresponding OIDs.
>
> The identifier parameters, as explained in Section 3, MUST be absent.

This seems to discuss algorithm identifier for ECDSA public keys
restricted to SHAKE128 or SHAKE256, and specifies that there are
no algorithm identifier parameters in public keys.

Normally, when using generic ECC keys, the curve used is encoded
as algorithm identifier parameter of public key. If multiple curves
of almost the same size are supported (e.g., there are multiple 
standard 256-bit curves), guessing the curve from encoding is
nontrivial at best, impossible at worst[1].

Now, since these restricted ECDSA keys seemingly do not have
similar curve identifiers, how is the curve used stored (Signature
identifiers do not specify that either)?

[1] E.g., compressed point with x=floor(10^76*pi)+4 is valid for the
256-bit NIST, Brainpool and ANSSI curves, plus the bitcoin curve.

-Ilari