Subject: Re: [TLS] Additional Elliptic Curves (Curve25519 etc) for TLS ECDH key agreement

From: Peter Gutmann <[email-masked]>
Date: Sun, 12 Jan 2014 06:40:05 +0000

Ilari Liusvaara <[email-masked]> writes:

>One problem with defining EdDSA for larger curves is that the needed hashes
>are large.

Are they?  You can use SHA-256 for everything if you want to keep things
manageable.

(Unless there's some odd requirement in TLS 1.2 that says that the hash has to
match the curve size).

Peter.

---

From: Ilari Liusvaara <[email-masked]>
Date: Sun, 12 Jan 2014 09:06:15 +0200

> (Unless there's some odd requirement in TLS 1.2 that says that the hash has to

EdDSA internally uses a hash in some places, and Ed25519 (which is ~255 bit
curve) defines that hash to be SHA-512.

Actually, reading the spec more carefully, the equations given for EdDSA seem
to assume cofactor 8 (all the E-curves are cofactor 4 by design) and double-
width hash.

Cofactor 4 would at least need replacing some constants...

-Ilari

---

From: Robert Ransom <[email-masked]>
Date: Sat, 11 Jan 2014 23:11:57 -0800

> to assume cofactor 8 (all the E-curves are cofactor 4 by design) and

<http://www.ietf.org/mail-archive/web/cfrg/current/msg03920.html> has more.

The root cause is that EdDSA requires twisted Edwards form with a=-1.
A good signature scheme for use within IETF should not fix the
group-element format.

Robert Ransom

---

From: Robert Ransom <[email-masked]>
Date: Sat, 11 Jan 2014 23:13:26 -0800

> Are they?  You can use SHA-256 for everything if you want to keep things

EdDSA uses its hash function in two other places:
* to expand the EdDSA secret key into two secrets: the secret exponent
of the public key, and a secret hash input Z; and
* to generate the per-message secret random exponents as a secretly
deterministic function of Z.

The latter use is the big issue.

Robert Ransom

---

From: Ilari Liusvaara <[email-masked]>
Date: Sun, 12 Jan 2014 09:54:05 +0200

> A good signature scheme for use within IETF should not fix the

Well, even if one drops all constraints that don't have obvious
reasons[1] and generalizes the formulas so math works there still
are some group elements in fixed format, specifically, due to the
H(R,A,m) factor.

[1] e.g. a=-1, h=8, p=4k+1, H is 2b bits.

-Ilari