Subject: Re: [CFRG] EdDSA square roots (RFC 8032)

From: John Mattsson <[email-masked]>
Date: Sun, 30 Jan 2022 21:45:36 +0000

I agree with Paul that RFC8032bis would make a lot of sense. In addition to the issues discussed in this thread:

- Purely deterministic per-message nonces are highly problematic both in IoT devices and in multi-signer settings. The issues are so significant that the only choices are to not use EdDSA or to implement the signing in a non-compliant way.

- Current constrained IoT devices use SHA-256 (in the future maybe SHAKE256, KangarooTwelve, or NIST LWC). Implementing SHA-512 just for EdDSA is not likely to happen. If EdDSA do not support the _hash_ function supported on the device, they will likely use ECDSA instead.

Cheers,
John

From: CFRG <[email-masked]> on behalf of Paul Hoffman <[email-masked]>
Date: Thursday, 23 December 2021 at 18:45
To: Ilari Liusvaara <[email-masked]>
Cc: [email-masked] <[email-masked]>
Subject: Re: [CFRG] EdDSA square roots (RFC 8032)
Given the information in this thread, and the observation that some
parts of RFC 8032 could be a lot clearer, revising the RFC with one that
obsoletes the old one would be helpful to the community.

--Paul Hoffman

_______________________________________________
CFRG mailing list
[email-masked]
https://protect2.fireeye.com/v1/url?k=31323334-501d5122-313273af-454445555731-40f7d10cf9eb7c69&q=1&e=f60e939a-eddb-4473-a458-a7147fae6d42&u=https%3A%2F%2Fwww.irtf.org%2Fmailman%2Flistinfo%2Fcfrg