Subject: Re: [Unbearable] Dumb idea: add Ed25519 support?

From: Brian Campbell <[email-masked]>
Date: Thu, 1 Sep 2016 10:20:32 -0600

Mea culpa below...

On Wed, Aug 31, 2016 at 3:01 PM, Bill Cox <[email-masked]> wrote:

>
> On Wed, Aug 31, 2016 at 1:10 PM, Brian Campbell <
> [email-masked]> wrote:
>
>>
>> On Wed, Aug 31, 2016 at 1:35 PM, Bill Cox <[email-masked]> wrote:
>>
>>> On Wed, Aug 31, 2016 at 12:12 PM, Brian Campbell <
>>> [email-masked]> wrote:
>>>
>>>> In which case I'd again suggest that the signature input be the
>>>> concatenated items directly (no hash) and that hashing or not be part of
>>>> the signature scheme associated with each key parameters type.
>>>>
>>>
>>> Sounds good to me.  It fits the standard APIs a bit better.  IIUC, this
>>> result is the same either way, so this is really just a matter of how we
>>> describe it, right?
>>>
>>
>> After playing around with some APIs yesterday, I don't think that the
>> result is actually the same. At least as far as the actual bytes of the
>> signature. Conceptually the idea is the same though, AFAIK, and moving the
>> hash definition to the signature scheme associated with each key
>> parameters type removes a hardwired dependency on SHA256 and also eliminates
>> a round of hashing for the RSA key parameters types.
>>
>
> The OpenSSL signing APIs are finicky.  They really want to do a digest,
> and you have to know how to call them just right to sign the digest, rather
> than the hash of the digest.  However, at one point, I was able to verify
> that both ways give the same result.  I actually use the normal APIs now
> that do the SHA256 while signing.
>
>

You're right. Both ways do give the same result. I managed to completely
forget that ECDSA isn't deterministic when I was trying to verify the
equivalence to myself using the APIs. So comparing the resulting signature
byte by byte wasn't a valid test. Doh! Sorry for my confusion and any
downstream confusion that may have caused.

---

From: Martin Thomson <[email-masked]>
Date: Fri, 9 Sep 2016 14:47:03 +1000

On 31 August 2016 at 06:41, Bill Cox <[email-masked]> wrote:
> Should we add Ed25519-SHA256 as a 4th key parameters type?

Be sure to specify which variant you want to use.  You don't want the
-ph variant, I think.

Also, Ed25519 uses SHA-512, so be careful in how you define this.
(See other discussion on this point.)