domain separation #139

kwantam · 2019-07-03T06:30:39Z

This essentially captures what's in #124:

add "HASH-TO-CURVE" literal in hash_to_base for H() separation
change ctr argument in encode_to_curve for free separation from hash_to_curve
add a new section in roadmap with requirements for domain separation
add a new definition for domain separation

Note that this does not comprehend #137. I think we can treat that as a separate question for now.

…or H()

samscott89 · 2019-07-03T12:23:42Z

draft-irtf-cfrg-hash-to-curve.md

  This is used to efficiently create independent
  instances of hash_to_base (see discussion above).

 Output: u, an element in F.

 Steps:
-1. m' = H(msg) || I2OSP(ctr, 1)
+1. m' = "HASH-TO-CURVE" || H(msg) || I2OSP(ctr, 1)


Would we consider making HASH-TO-CURVE shorter (e..g "H2C"/ "HTC"), and potentially truncating H(msg) such that we can fit m' into a single block in the loop below?

E.g. the input to the hash in the loop becomes "H2C" || H(msg)[..len(H) - 6] || I2OSP(ctr, 1) || I2OSP(i, 1) || I2OSP(j, 1)?

Perhaps in a separate issue?

we'd have to truncate a reasonable amount to avoid going past one block, because SHA-256 adds at least 65 bits of padding to the end of the message. Specifically, the padding is

append a single '1' bit

append k '0' bits where 0 <= k < 512 and bitlen(msg) + 1 + k + 64 is divisible by 512

append a 64-bit representation of bitlen(msg)

so it would have to be something like H(msg)[..len(H) - 15], which is pretty extreme.

Also, we might want to resolve #137 first, since that would moot this discussion.

chris-wood

The initial text looks good to me. I think some more clarity and examples would help drive the point home, so approving for now. Thanks, @kwantam!

draft-irtf-cfrg-hash-to-curve.md

chris-wood · 2019-07-03T13:36:07Z

draft-irtf-cfrg-hash-to-curve.md

+by that protocol.
+In practice, this assumption may not hold: commonly, two or more protocols
+may model the same hash function as a random oracle, which violates the above
+assumption if both protocols compute the hash of the same value.


Perhaps add:

That is, let R() be a random oracle used by protocols P1 and P2. If P1 and P2 ever query R with the same value x, the assumption above is violated.

And maybe then show how P1 and P2 would use R1 and R2 (as defined below) to address this?

Yeah, I think the first paragraph is unclear in a couple ways. I'll try to address and incorporate the above.

Done, I think.

draft-irtf-cfrg-hash-to-curve.md

chris-wood · 2019-07-03T13:43:14Z

draft-irtf-cfrg-hash-to-curve.md

+({{term-domain-separation}}) to avoid interfering with other protocols
+that also use the hash\_to\_curve functionality.
+In addition, any protocol that uses two or more hash\_to\_curve functions
+targeting different elliptic curves MUST enforce domain separation between


Is the expectation that if one had two hash-to-curve functions H1 and H2 targeting the same curve, then H1 = H2?

Yes, unless they're explicitly separated. I suppose I should clarify this point.

I pushed an edit to address this.

chris-wood · 2019-07-03T13:43:39Z

draft-irtf-cfrg-hash-to-curve.md

+({{term-domain-separation}}) to avoid interfering with other protocols
+that also use the hash\_to\_curve functionality.
+In addition, any protocol that uses two or more hash\_to\_curve functions
+targeting different elliptic curves MUST enforce domain separation between


It'd be good to clarify why this requirement is needed. (That is, to avoid overlapping hash2base output IIUC.)

I pushed an edit to address this.

chris-wood · 2019-07-03T13:47:21Z

draft-irtf-cfrg-hash-to-curve.md

+
+As an example, consider a fictional key exchange protocol named Quux.
+A reasonable choice of tag might be "QUUX-V\<xx\>-CS\<yy\>", where \<xx\> and \<yy\>
+are two-digit numbers indicating the version and ciphersuite, respectively.


Would it help to give an example of a protocol that needs domain separation internally, too?

I pushed an edit to address this.

draft-irtf-cfrg-hash-to-curve.md

chris-wood · 2019-07-03T13:49:29Z

draft-irtf-cfrg-hash-to-curve.md

  This is used to efficiently create independent
  instances of hash_to_base (see discussion above).

 Output: u, an element in F.

 Steps:
-1. m' = H(msg) || I2OSP(ctr, 1)
+1. m' = "HASH-TO-CURVE" || H(msg) || I2OSP(ctr, 1)


Perhaps in a separate issue?

armfazh

LGTM,

Co-Authored-By: Christopher Wood <[email protected]>

kwantam added 3 commits July 2, 2019 23:25

domain separation: definition and first cut at requirements

b3d15c9

encode_to_curve: set ctr = 2 for better separation from hash_to_curve

ff438fb

hash_to_base: prepend literal "HASH-TO-CURVE" for domain separation f…

2cdba98

…or H()

kwantam requested review from chris-wood, armfazh and samscott89 and removed request for chris-wood July 3, 2019 06:30

kwantam mentioned this pull request Jul 3, 2019

ciphersuites and domain separation #124

Closed

samscott89 reviewed Jul 3, 2019

View reviewed changes

chris-wood approved these changes Jul 3, 2019

View reviewed changes

armfazh approved these changes Jul 3, 2019

View reviewed changes

kwantam and others added 6 commits July 3, 2019 15:39

@chris-wood clarification in domain separation def'n

a9991a3

Co-Authored-By: Christopher Wood <[email protected]>

@chris-wood clarification in domain separation def'n

b26a58c

Co-Authored-By: Christopher Wood <[email protected]>

@chris-wood clarification in domain separation reqs

1387d77

Co-Authored-By: Christopher Wood <[email protected]>

@chris-wood clarification in domain separation def'n

6d947c1

Co-Authored-By: Christopher Wood <[email protected]>

@chris-wood clarification in domain separation reqs

b77e29a

Co-Authored-By: Christopher Wood <[email protected]>

address @chris-wood's remaining comments

b500bff

kwantam force-pushed the domain_separation branch from 0400920 to b500bff Compare July 3, 2019 21:53

chris-wood merged commit f764a27 into cfrg:master Jul 4, 2019

kwantam deleted the domain_separation branch July 4, 2019 23:58

kwantam mentioned this pull request Jul 5, 2019

meta-issue: triage for July 8th draft update #129

Closed

10 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

domain separation #139

domain separation #139

kwantam commented Jul 3, 2019

samscott89 Jul 3, 2019

chris-wood Jul 3, 2019

kwantam Jul 3, 2019

chris-wood left a comment

chris-wood Jul 3, 2019

kwantam Jul 3, 2019

kwantam Jul 3, 2019

chris-wood Jul 3, 2019

kwantam Jul 3, 2019

kwantam Jul 3, 2019

chris-wood Jul 3, 2019

kwantam Jul 3, 2019

chris-wood Jul 3, 2019

kwantam Jul 3, 2019

chris-wood Jul 3, 2019

armfazh left a comment

domain separation #139

domain separation #139

Conversation

kwantam commented Jul 3, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

chris-wood left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

armfazh left a comment

Choose a reason for hiding this comment