Subject: [IPsec] AD Review of Document: draft-ietf-ipsecme-eddsa

From: Eric Rescorla <[email-masked]>
Date: Sat, 26 Aug 2017 13:53:59 -0700

Document: draft-ietf-ipsecme-eddsa-00.txt

   In order to signal within IKE that no hashing needs to be done, we
   define a new value has in the SIGNATURE_HASH_ALGORITHMS notification,
   one that indicates that no hashing is performed.

s/has//

   The pre-hashed versions of Ed25519 and Ed448 (Ed25519ph and Ed448ph
   respectively) SHOULD NOT be used in IKE.

I wonder if this should be a MUST NOT, for two reasons:

1. Allowing the pre-hashed versions allows attacks based on collisions in
the hash function.
2. It means that receivers cannot safely reject pre-hashed versions without
interop problems.

It's also not clear to me how this would even work. They would just use the
OID values from some future document?

-Ekr