6 ms·
> malleability is not one of them, if one is following RFC 8032 This is like claiming Weierstrass curves don't have any problems if you follow the NIST/SECG st
by shinigami 6y ago
> malleability is not one of them, if one is following RFC 8032
This is like claiming Weierstrass curves don't have any problems if you follow the NIST/SECG standards. The whole point of the "SafeCurves" it to be easier to get them right, but you can still get them wrong.
- cryptbe 6y agoIf one implements EdDSA, but does not follow RFC 8032, one is doing it wrong on multiple levels.
- shinigami 6y agoIf one implements ECDSA, but does not follow SECG, one is also doing it wrong on multiple levels. Yet here we are.
- loup-vaillant 6y agoDaniel J. Bernstein et al's original paper (High-Speed High-Security Signatures), didn't feel the need to take as many precautions as RFC 8032. For instance, they didn't care about malleability. You seem to think they should have. May I ask why?
- tptacek 6y agoI'm interested in Thai's response to this question too, as I would be in any comment anyone managed to solicit from him about this topic, but an easy point to make here is that Bernstein was himself involved in RFC 8032, at least as a reviewer and contributor to the process, as you can quickly learn by reading the CFRG mailing list.
- loup-vaillant 6y agoOh, so DJB changed his mind then? Makes sense considering the application of EdDSA beyond signatures (I've heard malleability is a problem with zero-knowledge proofs, but I haven't studied that subject).