Subject: [Cfrg] Comments on draft-mattsson-cfrg-det-sigs-with-noise-02

From: Ruggero SUSELLA <[email-masked]>
Date: Wed, 6 May 2020 11:58:27 +0000

Dear All,

Disclosure: I'm coauthor of the reference [SBBDS17].

There is an inconsistency between the bit/bytes in the text.

Specifically in Section 4

"[SBBDS17<https://tools.ietf.org/html/draft-mattsson-cfrg-det-sigs-with-noise-02#ref-SBBDS17>] suggest a construction where the randomness is padded with zeroes so that the first 1024-bit SHA-512 block is composed only of the hashed private key and the random vale, but not the message.  The construction in this document follows this recommendation and pads with zeroes so that the first block is composed only of the hashed private key and the random value, but not the message."

But the description of the signature generation in section 2 reads "so that the length of (dom2(F, C) || Z || prefix || 000...)  is 1024 bytes" and, for ed448, "is chosen so that the length of (dom4(F, C) || Z || prefix || 000...)  is 1088 bytes."

These should be 1024 and 1088  bits respectively.

Best Regards,

Ruggero