minor fixes

This commit is contained in:
zzz
2019-03-13 11:25:50 +00:00
parent 36705c622a
commit 8eb0edcef0
3 changed files with 15 additions and 13 deletions

View File

@@ -326,7 +326,7 @@ Definitions
B
The Ed25519 base point (generator) 2^255 - 19 as in [ED25519-REFS]_
l
L
The Ed25519 order 2^252 + 27742317777372353535851937790883648493
as in [ED25519-REFS]_
@@ -384,7 +384,7 @@ GENERATE_ALPHA(destination, date, secret), for all parties:
secret = UTF-8 encoded string
seed = HKDF(H("I2PGenerateAlpha", keydata), datestring || secret, "i2pblinding1", 64)
// treat seed as a 64 byte little-endian value
alpha = seed mod l
alpha = seed mod L
{% endhighlight %}
BLIND_PRIVKEY(), for the owner publishing the leaseset:
@@ -395,7 +395,7 @@ BLIND_PRIVKEY(), for the owner publishing the leaseset:
alpha = GENERATE_ALPHA(destination, date, secret)
a = destination's signing private key
// Addition using scalar arithmentic
blinded signing private key = a' = BLIND_PRIVKEY(a, alpha) = (a + alpha) mod l
blinded signing private key = a' = BLIND_PRIVKEY(a, alpha) = (a + alpha) mod L
blinded signing public key = A' = DERIVE_PUBLIC(a')
{% endhighlight %}
@@ -438,11 +438,11 @@ The outer portion of the encrypted leaseset uses Red25519 keys and signatures.
Red25519 is similar to Ed25519. There are two differences:
Red25519 private keys are generated from random numbers and then must be reduced mod l, where l is defined above.
Red25519 private keys are generated from random numbers and then must be reduced mod L, where L is defined above.
Ed25519 private keys are generated from random numbers and then "clamped" using
bitwise masking to bytes 0 and 31. This is not done for Red25519.
The functions GENERATE_ALPHA() and BLIND_PRIVKEY() defined above generate proper
Red25519 private keys using mod l.
Red25519 private keys using mod L.
In Red25519, the calculation of r for signing uses additional random data,
and uses the public key value rather than the hash of the private key.

View File

@@ -5,7 +5,7 @@ New netDB Entries
:author: zzz, str4d, orignal
:created: 2016-01-16
:thread: http://zzz.i2p/topics/2051
:lastupdated: 2019-03-12
:lastupdated: 2019-03-13
:status: Open
:supercedes: 110, 120, 121, 122
@@ -46,6 +46,8 @@ The following proposals are somewhat related:
- 142 New Crypto Template (for new symmetric crypto)
- 144 ECIES-X25519-AEAD-Ratchet
- 145 ECIES-P256
- 146 Red25519
- 148 EdDSA-BLAKE2b-Ed25519
Proposal
@@ -761,7 +763,7 @@ Definitions
B
The Ed25519 base point (generator) 2^255 - 19 as in [ED25519-REFS]_
l
L
The Ed25519 order 2^252 + 27742317777372353535851937790883648493
as in [ED25519-REFS]_
@@ -820,7 +822,7 @@ GENERATE_ALPHA(destination, date, secret), for all parties:
secret = UTF-8 encoded string
seed = HKDF(H("I2PGenerateAlpha", keydata), datestring || secret, "i2pblinding1", 64)
// treat seed as a 64 byte little-endian value
alpha = seed mod l
alpha = seed mod L
{% endhighlight %}
BLIND_PRIVKEY(), for the owner publishing the leaseset:
@@ -833,7 +835,7 @@ BLIND_PRIVKEY(), for the owner publishing the leaseset:
alpha = GENERATE_ALPHA(destination, date, secret)
a = destination's signing private key
// Addition using scalar arithmentic
blinded signing private key = a' = BLIND_PRIVKEY(a, alpha) = (a + alpha) mod l
blinded signing private key = a' = BLIND_PRIVKEY(a, alpha) = (a + alpha) mod L
blinded signing public key = A' = DERIVE_PUBLIC(a')
{% endhighlight %}
@@ -879,11 +881,11 @@ The outer portion of the encrypted leaseset uses Red25519 keys and signatures.
Red25519 is almost identical to Ed25519. There are two differences:
Red25519 private keys are generated from random numbers and then must be reduced mod l, where l is defined above.
Red25519 private keys are generated from random numbers and then must be reduced mod L, where L is defined above.
Ed25519 private keys are generated from random numbers and then "clamped" using
bitwise masking to bytes 0 and 31. This is not done for Red25519.
The functions GENERATE_ALPHA() and BLIND_PRIVKEY() defined above generate proper
Red25519 private keys using mod l.
Red25519 private keys using mod L.
In Red25519, the calculation of r for signing uses additional random data,
and uses the public key value rather than the hash of the private key.

View File

@@ -5,7 +5,7 @@ EdDSA-BLAKE2b-Ed25519
:author: zzz
:created: 2019-03-12
:thread: http://zzz.i2p/topics/2689
:lastupdated: 2019-03-12
:lastupdated: 2019-03-13
:status: Open
.. contents::
@@ -26,7 +26,7 @@ Motivation
During discussions and design of NTCP2 (proposal 111) and LS2 (proposal 123),
we briefly considered various attacks that were possible, and how to
prevent them. Three of these attacks are Length Extension Attacks,
Reuse of Signed Data, and Dupicate Message Identification.
Reuse of Signed Data, and Duplicate Message Identification.
For both NTCP2 and LS2, we decided that
these attacks were not directly relevant to the proposals at hand,