paulmillr/noble-ed25519

ed25519ph/HashEdDSA support?

brandonros opened this issue · 5 comments

brandonros commented

HashEdDSA, shortened as Ed25519ph when coupled with Edwards25519 (and where ph stands for "prehash").

paulmillr commented

What's your use case?

zamicol commented

Like ECDSA, we use systems that sign digests. ES224, ES256, ES384, ES512 work well with this.

PureEdDSA prefers the original message. It would be awesome to have Ed25519ph that conforms to same design pattern as ECDSA.

I would also add, the latest FIPS draft is requiring ed25519ph support.

G̶o̶ ̶1̶.̶1̶9̶ Go 1.20 will implemented this: golang/go#31804. PyNaCl is also working on high level support.

  • 👍1
paulmillr commented

How should the ph api look like to be simple?

zamicol commented

As far as API, how about signDigest and verifyDigest?

Looking at this line:

export { getPublicKey, sign, verify, utils, CURVE, Point, ExtendedPoint, RistrettoPoint };

The exported would become:

export { getPublicKey, sign, verify, signDigest, verifyDigest, utils, CURVE, Point, ExtendedPoint, RistrettoPoint };

Edit: I was also thinking "signPH" and "verifyPH" might be more descriptive for those already familiar with Ed.

  • 👍2