Skip to content

Edit Signature sections in draft-miller-sshm-composite-sigs. #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cindylindeed wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Edit Signature sections in draft-miller-sshm-composite-sigs. #18

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 28 additions & 34 deletions draft-miller-sshm-composite-sigs.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -285,14 +285,13 @@
<section><name>Signature contexts</name>
<t>
The <xref target="I-D.ietf-lamps-pq-composite-sigs" />
composite signature scheme, like its
composite signature scheme used here, like its
underlying ML-DSA component, accepts a Context
parameter that may be used to enforce domain
separation between signatures.
parameter that is used to domain separate signatures.
</t>
<t>
In all cases in the SSH protocol, this
context value is the empty string.
context value MUST be the empty string.
</t>
</section>
<section anchor="sig"><name>Signature Generation</name>
Expand All @@ -319,8 +318,8 @@
to the signature algorithm.
</li>
<li>
len(ctx): A single byte representing
the length of the context string.
len(ctx): A single unsigned byte representing the length
of the context string.
</li>
<li>
ctx: The context string.
Expand All @@ -331,12 +330,10 @@
</li>
</ul>
<t>
The signer then computes and combines the ML-DSA and
Elliptic Curve signatures as described in the following
sections. In the algorithm invocations below, mldsa_sk,
ed25519_sk, and ecdsa_sk denote the private signing
keys derived from or represented by mldsa_seed,
ed25519_seed, and d, respectively.
The signer computes and combines the ML-DSA and Elliptic Curve
signatures. Below, mldsa_sk, ed25519_sk, and ecdsa_sk are the
private signing keys derived from or represented by
mldsa_seed, ed25519_seed, and d, respectively.
</t>
<section anchor="sig-ed"><name>ssh-mldsa44-ed25519</name>
<t>
Expand All @@ -348,8 +345,7 @@
creating the M' message to be signed.
</t>
<t>
The ML-DSA and Ed25519 signatures are then
calculated as:
The ML-DSA and Ed25519 signatures are calculated as:
</t>
<ul>
<li>
Expand All @@ -360,8 +356,8 @@
</li>
</ul>
<t>
The final composite signature is the
concatenation of mldsa_sig and ed25519_sig.
The final composite signature is the concatenation of
mldsa_sig and ed25519_sig in this order.
</t>
<sourcecode>
byte[2420] mldsa_sig
Expand All @@ -383,8 +379,7 @@
the M' message to be signed.
</t>
<t>
The ML-DSA and ECDSA signatures are then
calculated as:
The ML-DSA and ECDSA signatures are calculated as:
</t>
<ul>
<li>
Expand All @@ -395,8 +390,8 @@
</li>
</ul>
<t>
The final composite signature is the
concatenation of mldsa_sig, r, and s.
The final composite signature is the concatenation of
mldsa_sig, r, and s in this order.
</t>
<sourcecode>
byte[4896] mldsa_sig
Expand Down Expand Up @@ -431,20 +426,17 @@
</section>
<section><name>Signature Verification</name>
<t>
To verify a signature, the verifier
reconstructs M' using the same process as
defined for signature generation. The verifier then
verifies the ML-DSA and Elliptic Curve
signatures as described in the following
sections.
To verify a signature, the verifier reconstructs M'
using the same process as defined for signature
generation and verifies the ML-DSA and Elliptic Curve
signatures.
</t>
<t>
Both verification operations MUST return success
for the composite signature to verify
successfully. Failure
of either the ML-DSA or Elliptic Curve
verification MUST cause the verification of
the composite signature to fail.
Both ML-DSA and Elliptic Curve verification operations
MUST return success for the composite signature to
verify successfully. Failure of either verification
operation MUST cause the composite signature
verification to fail.
</t>
<section><name>ssh-mldsa44-ed25519</name>
<t>
Expand All @@ -460,7 +452,8 @@
</li>
</ul>
<t>
The verifier then checks both results as described above.
Both signatures must verify for the composite signature
to verify.
</t>
</section>
<section><name>ssh-mldsa87-p384</name>
Expand All @@ -477,7 +470,8 @@
</li>
</ul>
<t>
The verifier then checks both results as described above.
Both signatures must verify for the composite signature
to verify.
</t>
</section>
</section>
Expand Down