Subject: [Cfrg] I-D Action: draft-irtf-cfrg-eddsa-03.txt

From: [email-masked]
Date: Tue, 01 Mar 2016 12:30:45 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Crypto Forum of the IETF.

        Title           : Edwards-curve Digital Signature Algorithm (EdDSA) 
        Authors         : Simon Josefsson
                          Ilari Liusvaara
	Filename        : draft-irtf-cfrg-eddsa-03.txt
	Pages           : 52
	Date            : 2016-03-01

Abstract:
   The elliptic curve signature scheme Edwards-curve Digital Signature
   Algorithm (EdDSA) is described.  The algorithm is instantiated with
   recommended parameters for the edwards25519 and edwards448 curves.
   An example implementation and test vectors are provided.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-irtf-cfrg-eddsa/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-irtf-cfrg-eddsa-03

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-irtf-cfrg-eddsa-03

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Ilari Liusvaara <[email-masked]>
Date: Tue, 1 Mar 2016 22:35:37 +0200

> https://www.ietf.org/rfcdiff?url2=draft-irtf-cfrg-eddsa-03

Posted a new version that tries to address the RGLC comments and also
refrormats the parameter tables to be hopefully clearer.

(Had to work around some issues with the XML... Hopefully the result
looks sane).

-Ilari

---

From: "Paterson, Kenny" <[email-masked]>
Date: Tue, 1 Mar 2016 20:41:21 +0000

Hi Ilari,

Many thanks to you and Simon for your efforts in moving this ID forwards.

Folks reading on the list: we are very keen to get your input on this
draft as we close out our work on signatures. If you have the expertise,
please read carefully and let us know about any nits or other issues you
find.

Thanks

Kenny 

On 01/03/2016 20:35, "Cfrg on behalf of Ilari Liusvaara"
<[email-masked] on behalf of [email-masked]> wrote:

>_______________________________________________
>Cfrg mailing list
>[email-masked]
>https://www.irtf.org/mailman/listinfo/cfrg

---

From: Mike Hamburg <[email-masked]>
Date: Tue, 1 Mar 2016 16:25:41 -0800

Hi Simon and Ilari,

I’m working to implement the draft, and I’m curious about the Ed448ph test vectors.

They set the private key to 32 bytes:
   833fe62409237b9d62ec77587520911e
   9a759cec1d19755b7da901b96dca3d42

However, the spec says that "The secret key is 57 octets (456 bits, corresponding to b) of cryptographically-secure random data."

It would of course be secure to use a key length other than 57 bytes for Ed448, prehashed or otherwise.  It’s only the seed to an expansion hash, and could be set at 32 octets without losing meaningful security (or even 28 octets in the single-key setting, but this loses security against multi-key attacks).  However, the spec seems to require 57 bytes.

Is the test vector missing some bytes, or are Ed448 keys allowed to be other lengths?

Thanks,
— Mike

> On Mar 1, 2016, at 12:41 PM, Paterson, Kenny <[email-masked]> wrote:
> 
> Hi Ilari,
>

---

From: Ilari Liusvaara <[email-masked]>
Date: Wed, 2 Mar 2016 17:47:36 +0200

> Is the test vector missing some bytes, or are Ed448 keys allowed to be other lengths?

Missing some bytes. Thanks for the report.

-Ilari