How to select the ASN.1 structure of EC-SDSA (Schnorr signature with ECC)?

Hi folks,
TLDR;
is anywhere in PKIX the ASN1 format of the EC based Schnorr digital 
signature algorithm EC-SDSA
(aka https://oid-rep.orange-labs.fr/get/1.0.14888.3.0.13)
defined?


This signature algo has the advantage, that it provides the full 
strength of the hash function used, regardless of the strength (bit 
length) of the underlying curve.

Just to recall, it is defined as follows:

Input:
	base point G of an elliptic curve
	privat key X (integer)
	public key [X]∙G (point on the curve)
	message to be signed M (octet string)

Signing:
(FE2BS is the straight-forward field element to bit string conversion, 
and BS2I the conversion of a base 2 representation to an integer)
	select a random integer K
	compute the pre-signature P = [K]∙G (point on the curve)
	witness R is computed as the hash of the x-coordinate PX of
   	point P concatenated with the message M:
		R = h(FE2BS(PX) || M).
	the second part S of the signature (R,S) is computed as
		S = K + BS2I(R)X

Verification:
	recompute the pre-signature
		P' = S∙G – BS2I(R)∙Y
	recompute the witness
		R' = h(FE2BS(P'X) || M)
	accept if R = R'

In contrast to EC-DSA, where the elements R and S of the signature are 
both integers, we got here the full length (no truncation as for EC-DSA) 
hash value as a bit string R and an integer S.

So I guess that the ASN.1 structure for EC-SDSA should be defined as

ECSDSA-Sig-Value ::= SEQUENCE {
       r     BIT STRING,
       s     INTEGER }

Is that correct?

Thanks for any suggestions
/Ernst.

_______________________________________________
pkix mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/pkix