Subject: [Dcrup] Hash-alg versus sig-alg

From: Scott Kitterman <[email-masked]>
Date: Thu, 30 Nov 2017 20:36:30 -0500

RFC 6376 says both these things (page 31):

hash-alg:   is the hashing algorithm specified in the "a" parameter.

sig-alg:    is the signature algorithm specified by the "a"
            parameter.

For sha-1/sha-256 these were always the same.  As I understand it, for RFC 
8032 HashEdDSA ed25519, that's not true.  I think sig-alg is ed25519, but it 
uses sha-512 internally as the hash algorithm.  My assumption then is that if 
the "a" parameter is ed25519, then when calculating the body hash for the bh= 
tag, one should canonicalize and then hash with sha-512.  Is that right?

Assuming it is, that probably needs be explicitly stated in the updated draft.

How's that coming?

Scott K

---

From: "John Levine" <[email-masked]>
Date: 1 Dec 2017 01:39:33 -0000

>tag, one should canonicalize and then hash with sha-512.  Is that right?

Nope.  The canonicalization process does exactly what it's always
done, smooshing the header and body text and making sha-256 hashes of
it.  Then it hands the header hash to HashEdDSA which internally takes
that hash and makes a sha-512 hash of it and signs that.  That second
hash doesn't do anything useful, but we hear that PureEdDSA isn't
likely to be widely implemented while HashEdDSA is so we'll go with
what we're likely to get.

>Assuming it is, that probably needs be explicitly stated in the updated draft.

I was waiting to hear if there were any objection to our tentative decision in
Singapore to ditch the RSA signatures with fingerprints.  Hearing none, I will
hack it out of the draft.

One remaining nit is whether to keep the p= tag in the signatures
which has a copy of the verification key.  For rsafp we needed it, for
ed25519 we don't.  Martin Thompson mentioned an arcane key reverse
engineering attack that the p= tag deterred but I think that only
applies to RSA, not elliptical curve crypto.

R's,
John

---

From: Scott Kitterman <[email-masked]>
Date: Fri, 01 Dec 2017 02:35:52 +0000

>what we're likely to get.

Thanks for the clarification.

>applies to RSA, not elliptical curve crypto.

Looking forward to it.

Scott K

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Thu, 30 Nov 2017 23:09:47 -0800

<chair> Yes, please proceed.  There's been no objection raised.  </chair>

> applies to RSA, not elliptical curve crypto.

IMHO, we should drop it.  Unless I've missed something, at this point
there's no reason it should be any different than how we've always done it
with RSA keys.

-MSK