ed25519ph/HashEdDSA support?

[brandonros]

HashEdDSA, shortened as Ed25519ph when coupled with Edwards25519 (and where ph stands for "prehash").

[paulmillr]

What's your use case?

[zamicol]

Like ECDSA, we use systems that sign digests. ES224, ES256, ES384, ES512 work well with this.

PureEdDSA prefers the original message. It would be awesome to have Ed25519ph that conforms to same design pattern as ECDSA.

I would also add, the latest FIPS draft is requiring ed25519ph support.

• https://csrc.nist.gov/publications/detail/fips/186/5/draft
• https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5-draft.pdf See section 7.8

G̶o̶ ̶1̶.̶1̶9̶ Go 1.20 will implemented this: https://github.com/golang/go/issues/31804. PyNaCl is also working on high level support.

[paulmillr]

How should the ph api look like to be simple?

[zamicol]

As far as API, how about signDigest and verifyDigest?

Looking at this line:

export { getPublicKey, sign, verify, utils, CURVE, Point, ExtendedPoint, RistrettoPoint };

The exported would become:

export { getPublicKey, sign, verify, signDigest, verifyDigest, utils, CURVE, Point, ExtendedPoint, RistrettoPoint };

Edit: I was also thinking "signPH" and "verifyPH" might be more descriptive for those already familiar with Ed.

[paulmillr]

fixed in https://github.com/paulmillr/noble-curves