Subject: Re: [Cfrg] Elliptic Curves - signature: shorter signatures versa batch verification (ends on August 21st)

From: Malisa VUCINIC <[email-masked]>
Date: Tue, 18 Aug 2015 22:06:47 +0200

In the context of energy-harvested IoT devices and IEEE 802.15.4 techno, whether a resulting message fits within one 127 byte radio frame is often a determining factor if a given protocol/algorithm will be considered in the picture. Out of those 127 bytes, one needs to account for 40-50 bytes of network protocol overhead, leaving about 80 bytes for the application to handle. In that setting, a signature of 48 or 64 bytes makes all the difference.

+1 on adopting the short signature approach and spelling out the security implications.

Regards,

Mališa

On 2015-08-17 08:36, "Göran Selander" <[email-masked]<mailto:[email-masked]>> wrote:

I am not the expert either, but the issue with message size exceeding
certain frame sizes has been raised in certain IoT settings, and the
difference between 64 bytes and 48 bytes signature may be the difference
between fitting into the frame or not. The implications includes
fragmentation, which may have security implications in itself, but
apparently also bad transmission characteristics and high energy
consumption since in certain settings the main power consumption is
related to (wireless) transmission.

If CFRG will not provide a recommendation of an algorithm with shorter
signature, it may happen that applications that are restricted in message
size will either only encrypt or try to do something with symmetric
algorithms instead (which of course not necessarily gives the appropriate
security properties).

I agree it would be good to have an algorithm with shorter signature, with
a caveat spelling out the security implications.

Göran