Re: [CFRG] An update on Web Crypto, and adopting CFRG curves

[Daniel Huigens <[e-mail]>]

On Tuesday, August 16th, 2022 at 14:27, Hubert Kario wrote:

> If we want consistency between implementations of ed25519, I'm afraid that
> it will be a long road to that:
> 
> https://hdevalence.ca/blog/2020-10-04-its-25519am

This (draft) spec aims to standardize & ensure consistency between
implementations of Ed25519 in Web Crypto only (along with the other
algorithms), not Ed25519 implementations in general. I agree that would
be much more difficult.

Of course, an implementation of Web Crypto will still have to call out
to a crypto library implementing Ed25519 at some point. However, the
checks proposed in [1] can, in principle, be done by the Web Crypto
implementation, by checking keys and signatures against a hardcoded
list of small-order elements. Of course it would be better if the
crypto library would implement that, though - but often browsers at
least are also in control of that (e.g. Firefox has NSS and Chrome has
BoringSSL, a fork of OpenSSL) - so I think that shouldn't be a huge
issue.

However, if you see some issue with these checks, please let me know.

Best,
Daniel

[1]: https://github.com/WICG/webcrypto-secure-curves/pull/13