golang/go

crypto/ed25519: doc of Sign should warn not to prehash messages

Open

#36,761 opened on Jan 25, 2020

View on GitHub
 (1 comment) (2 reactions) (0 assignees)Go (19,008 forks)batch import
DocumentationNeedsFixhelp wanted

Repository metrics

Stars
 (133,883 stars)
PR merge metrics
 (No merged PRs in 30d)

Description

Typically, digital signature schemas require the user to first hash the payload and then sign it. Correct me if I am wrong, but this should be true for RSA, DSA and ECDSA.

If my understanding is right, ED25519 seems to be different: it already hashes the message in a way that the collision resistant property is guaranteed even when it becomes feasible to find a collision for SHA512. Thus, prehashing the input messages basically nullifies this collision resistant property of ED25519 itself. In fact, if a possible attacker can efficiently find a collision for the prehashed message, they would be able to carry out a forgery attack.

Also, according to RFC8032 section 8.7 , it would be better to mention to avoid signing large messages.

/cc @FiloSottile @katiehockman

Contributor guide

Research direction
Read the crypto/ed25519 package documentation and RFC 8032 section 8.7, then propose a warning note to discourage prehashing and suggest handling large messages.
Tech stack
go
Domain
backendsecurity
Issue type
Documentation
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Under 1 hour
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
Gocryptography basics
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
80