Subject: [Cfrg] EC signatures: Quaker poll on preferred scheme, ends on September 24th

From: Alexey Melnikov <[email-masked]>
Date: Thu, 10 Sep 2015 18:27:37 +0100

Dear CFRG,

We previously asked for a short discussion to flush out any last issues or additional points of comparison between the different candidate signature schemes that everyone should be aware of. A few interesting and potentially important topics were raised by various people - thank you for those inputs. Roughly, those topics were:

- IPR considerations
- Implementation and deployment status
- Facility to sign without public key
- Facility to verify without public key
- Reuse of same keys with IUF and non-IUF schemes (but note that, based on the outcome of an earlier poll, we are only working on a scheme for the IUF interface)
- Coordinate system independence

We want to keep these topics in the foreground, but feel strongly that any scheme changes that might be decided upon as a result of their further consideration could equally well be made to any of the current candidates. (If authors of different proposals disagree with this assertion, they should speak up now.)

In view of this, we would now like to run a poll to decide on which one of the current candidates we will take forward and develop. As a reminder, those four candidates are:

"ladd", "liusvaara", "brown", and "eddsa" (Bernstein et al)

with "hamburg" having been eliminated at an earlier stage.

This message starts a 2 weeks Quaker poll that would close on September 24th. Please reply +1 (prefer or greatly favor), 0 (can live with or accept) or -1 (cannot live with or tolerate)) for each of the 4 signature schemes. Short explanation of your position are welcome, but this is not a time for rehashing old debates. Pointing to older messages on the mailing list is also encouraged.

As a usual reminder, please don't discuss other topics in this thread.

Once the poll is completed, and assuming there is a clear preference arising from the group, we (the chairs) will then seek volunteers to join an editorial team whose job will be to develop an Internet draft describing the selected scheme. As usual, that team will be expected to respond to suggestions for changes to the draft that have the CFRG support; we may run further polls to help determine any such changes.

Best Regards,
Kenny and Alexey

---

From: Dan Brown <[email-masked]>
Date: Thu, 10 Sep 2015 17:58:47 +0000

0 =="ladd", 
0 == "liusvaara", 
+1 == "brown", 
0 == "eddsa".

---

From: Dan Brown <[email-masked]>
Date: Thu, 10 Sep 2015 18:25:54 +0000

> - Reuse of same keys with IUF and non-IUF schemes (but note that, based on
> the outcome of an earlier poll, we are only working on a scheme for the
IUF
> interface)
> 
> We want to keep these topics in the foreground, but feel strongly that any
> scheme changes that might be decided upon as a result of their further
> consideration could equally well be made to any of the current candidates.
(If
> authors of different proposals disagree with this assertion, they should
speak
> up now.)

I agree that IUF issues can be handled similarly across the current
proposals by making some adjustments (i.e. proposal xyz amended to xyz',
e.g. by dropping the H(R,M) mode of eddsa and requiring H(R,H(M))).

Nonetheless, some people might compare the security of the strictly-IUF
initial proposals brown and ladd to the non-IUF modes of eddsa and
liusvaara, even though CFRG may later adjust the winning proposal to align
with a single approach to the IUF issue.  For example, DJB sent an email to
CFRG rating the best-to-worst of H(R,M), H(M,R) and H(R,H(M)), which, if
taken out of context, might be mapped to the current proposals (i.e. rather
than as a way to handle IUF issue which is equally applicable to whatever
current scheme is accepted for adjustment).

---

From: Tony Arcieri <[email-masked]>
Date: Fri, 11 Sep 2015 20:02:30 -0700

I prefer EdDSA or a variant thereof:

+1: eddsa
+1: liusvaara

I accept non-EdDSA Schnorr-based schemes:

0: "ladd" (I still like your scheme, but I like the other schemes better)

I actively oppose non-Schnorr schemes:

-1: "brown"

---

From: Alyssa Rowan <[email-masked]>
Date: Sun, 13 Sep 2015 09:59:31 +0100

On 2015-09-10 18:27, Alexey Melnikov wrote:

> In view of this, we would now like to run a poll to decide on which
> one of the current candidates we will take forward and develop.

eddsa: +1
ladd: 0
liusvaara: 0
brown: -1

- -- 
/akr

---

From: "Dan Harkins" <[email-masked]>
Date: Wed, 16 Sep 2015 19:37:22 -0700 (PDT)

On Thu, September 10, 2015 10:27 am, Alexey Melnikov wrote:
> In view of this, we would now like to run a poll to decide on which one of
> the current candidates we will take forward and develop. As a reminder,
> those four candidates are:
>

  Ladd, Liusvaara, Brown, or Bernstein...

  Well I'm sure they're all for world peace so when is
the swimsuit portion of this competition?

  Dan.

---

From: Watson Ladd <[email-masked]>
Date: Wed, 16 Sep 2015 22:39:36 -0400

+1 "eddsa"
0 to all others: they offer no compelling advantages.

On Wed, Sep 16, 2015 at 10:37 PM, Dan Harkins <[email-masked]> wrote:
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://mail.ietf.org/mailman/listinfo/cfrg

-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.

---

From: Alexey Melnikov <[email-masked]>
Date: Sat, 26 Sep 2015 20:50:18 +0100

On 10/09/2015 18:27, Alexey Melnikov wrote:
> Dear CFRG,
> 
> We previously asked for a short discussion to flush out any last issues
> or additional points of comparison between the different candidate
> signature schemes that everyone should be aware of. A few interesting
> and potentially important topics were raised by various people - thank
> you for those inputs. Roughly, those topics were:
> 
> - IPR considerations
> - Reuse of same keys with IUF and non-IUF schemes (but note that, based
> on the outcome of an earlier poll, we are only working on a scheme for
> the IUF interface)
> We want to keep these topics in the foreground, but feel strongly that
> any scheme changes that might be decided upon as a result of their
> further consideration could equally well be made to any of the current
> candidates. (If authors of different proposals disagree with this
> assertion, they should speak up now.)
> 
> In view of this, we would now like to run a poll to decide on which one
> of the current candidates we will take forward and develop. As a
> reminder, those four candidates are:
> 
> This message starts a 2 weeks Quaker poll that would close on September
> 24th. Please reply +1 (prefer or greatly favor), 0 (can live with or
> accept) or -1 (cannot live with or tolerate)) for each of the 4
> signature schemes. Short explanation of your position are welcome, but
> this is not a time for rehashing old debates. Pointing to older messages
> on the mailing list is also encouraged.
> 
> Once the poll is completed, and assuming there is a clear preference
> arising from the group, we (the chairs) will then seek volunteers to
> join an editorial team whose job will be to develop an Internet draft
> describing the selected scheme. As usual, that team will be expected to
> respond to suggestions for changes to the draft that have the CFRG
> support; we may run further polls to help determine any such changes.

Dear CFRG participants,
It looks like there is preference for eddsa, but there is shortage of
answers to this poll. If anybody else wants to state his/her opinion
(publicly and privately) by the end of Monday, 28th. If no major new
feedback is given, chairs will declare rough consensus for the eddsa
signature scheme.

Best Regards,
Alexey

---

From: Stephen Farrell <[email-masked]>
Date: Sat, 26 Sep 2015 21:04:20 +0100

> feedback is given, chairs will declare rough consensus for the eddsa

Since I've not had time to delve into the algorithms I didn't express
an opinion. If it makes a difference though I do think that eddsa is
the option that seems to have both backing from RG participants and a
team of folks willing and able to do the work. So consider me an
unqualified +1 for eddsa as well if you like.

S.

---

From: James Cloos <[email-masked]>
Date: Sat, 26 Sep 2015 18:05:36 -0400

>>>>> "SF" == Stephen Farrell <[email-masked]> writes:

SF> Since I've not had time to delve into the algorithms I didn't
SF> express an opinion. If it makes a difference though I do think
SF> that eddsa is the option that seems to have both backing from RG
SF> participants and a team of folks willing and able to do the work.
SF> So consider me an unqualified +1 for eddsa as well if you like.

I'm sure a lot of us who didn't vote came to that same conclusion.

-JimC
-- 
James Cloos <[email-masked]>         OpenPGP: 0x997A9F17ED7DAEA6

---

From: Taylor R Campbell <[email-masked]>
Date: Sun, 27 Sep 2015 21:21:27 +0000

Date: Sat, 26 Sep 2015 20:50:18 +0100
   From: Alexey Melnikov <[email-masked]>

+1 eddsa
0 ladd
0 liusvaara
-1 brown

---

From: Harry Halpin <[email-masked]>
Date: Sun, 27 Sep 2015 17:29:14 -0400

+1 eddsa
0 ladd
0 liusvaara
0 brown

Without W3C hat on.

      cheers,
            harry

---

From: Zooko Wilcox-OHearn <[email-masked]>
Date: Mon, 28 Sep 2015 19:23:05 +0000

I have not studied the alternatives, so my opinion is uninformed, but
since I've already been using and supporting Ed25519 for years, I'd be
most comfortable with eddsa:

+1 eddsa
0 ladd
0 liusvaara
0 brown

---

From: Yoav Nir <[email-masked]>
Date: Tue, 29 Sep 2015 00:44:48 +0300

> On Sep 27, 2015, at 1:05 AM, James Cloos <[email-masked]> wrote:
> 

I agree.

Yoav