Re: Closing: How to select the ASN.1 structure of EC-SDSA (Schnorr signature with ECC)?

On 8/26/2022 4:17 AM, Ernst G Giessmann wrote:
> Summarizing:
> There is no RFC or Draft defining EC-SDSA signature algorithm support 
> (like RFC 8410 for Ed25519 or RFC 9215 for GOST).

BTW - someone is going to have to bite the bullet and buy the ISO spec 
to confirm they didn't already specify the encoding and so state in any 
RFC.   That's an objection I'll lodge against publication if not 
resolved. Given that an OID already maps to that signature type, I would 
be hard pressed to believe that the ISO folks didn't have their own 
ideas of what the signature looked like when thrown into a certificate 
or other CMS item.


>
> The ASN.1 encoding for EC-SDSA signature could be selected as similar 
> to EC-DSA (sequence two integers), following the structure of the 
> signature (sequence of octet string and integer) or raw bit string 
> (encoded octet string R concatenated with encoded octet string S as 
> EdDSA signatures). The latter seems to be preferable.

Actually 4 approaches:

BitString(0, Encode(Sequence (Integer R, Integer S) -  Where R is 
OS2I(r)) -- I actually believe (given the perusal of the German version 
of EC-SDSA) that this is the correct one.

BitString (0, Encode(Sequence (OCTET STRING R, Integer S))- where the 
contents of the octet string are the hash value r

BitString (0, Encode(OCTET STRING (r || I2OS(s))) -

BitString (0, r || I2OS(s));

The signature does not necessarily need to wrap an ASN1 structure.

Later, Mike

>
> Thanks for help.
> /Ernst.
>
> _______________________________________________
> pkix mailing list
> [email protected]
> https://www.ietf.org/mailman/listinfo/pkix


_______________________________________________
pkix mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/pkix