Please stop hashing the public key first (or: ML-DSA's µ annoys me)
4 points by tris
4 points by tris
One nice property that all of these protocols have (except XML Digital Signatures, but nobody thinks XML Digital Signatures were a good idea) is that they carry the signing method in a header.
No no no, that's a terrible property which leads to algorithm confusion attacks in which an attacker can bypass verification by tricking the verifier into using the wrong algorithm to verify the signature.
The whole point of signing something is that the message is untrusted until it has been verified. Therefore, you can't trust the message to faithfully tell you how you're supposed to verify it.
It's fine for the message to carry a key ID that the verifier uses as a hint to look up the public key in the set of trusted keys, instead of doing trial verifications with each one. The author should really be complaining about protocols lacking a unique key ID rather than the order in which ML-DSA hashes the public key.