paulmillr/noble-ed25519

Does sign() take a message or its hash?

hoffa opened this issue · 1 comments

hoffa commented

The README suggests the first parameter to sign() is the message hash:

const msgHash = 'deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef';
...
  const signature = await ed.sign(msgHash, privateKey);

However the implementation suggests the parameter is the message itself, and not necessarily a hash:

noble-ed25519/index.ts

Lines 818 to 820 in f2881cb

const r = await sha512ModnLE(prefix, msg); // r = hash(prefix + msg)
const R = Point.BASE.multiply(r); // R = rG
const k = await sha512ModnLE(R.toRawBytes(), pubBytes, msg); // k = hash(R + P + msg)

The referenced RFC also seems to mention nothing about hashing for the function input:

The inputs to the signing procedure is the private key, a 32-octet string, and a message M of arbitrary size.

It's message, I should adjust docs.