[Dcrup] DKIM-Signing hashes with Ed25519

[Дилян Палаузов <[e-mail]>]

Hello,

the algoritm described in RFC 6376 “DomainKeys Identified Mail (DKIM)
Signatures” for signing a message is:

1. Normalize/Canonicalize (Section 5.3)
2. Compute hash (Section 5.5): “The Signer MUST compute the message
hash as described in Section 3.7 and then sign it using the selected
public-key algorithm.”
3. Sign the hash (Section 5.6):  “The DKIM-Signature header field MUST
be the same as used to compute the hash as described above, except that
the value of the "b=" tag MUST be the appropriately signed hash
computed in the previous step…”

This RFC describes the rsa-sha256 algorithm for signing (for the
aforementioned hash).

RFC 8463 “A New Cryptographic Signature Method for DomainKeys
Identified Mail (DKIM)” adds the Ed25519-SHA256 signing algorithm
(Section 3): “The Ed25519-SHA256 signing algorithm computes a message
hash as defined in Section 3 of [RFC6376] using SHA-256 [FIPS-180-4-
2015] as the hash-alg.  It signs the hash with the PureEdDSA variant
Ed25519, as defined in RFC 8032, Section 5.1 [RFC8032].”

At https://www.ietf.org/mail-archive/web/dcrup/current/msg00501.html is
stated, that GnuTLS does ED25519 signing of data, but not of hashed —
ED25519 is not meant for the latter.  The answer at 
https://www.ietf.org/mail-archive/web/dcrup/current/msg00502.html says,
that “if the spec says there’s a pure version that doesn’t hash its
input, the library would implement it.”

I asked at https://gitlab.com/gnutls/gnutls/issues/613 to enhance
GnuTLs to sign per RFC 8463.  The answer is, that there is a pure
EdDSA, which can sign data.  A pre-hashed-EdDSA version, which can sign
hashes, is not standardized.

Please join https://gitlab.com/gnutls/gnutls/issues/613 to explain what
signing ED25519 hashes mean and how and shall it be implemented.

Regards
  Дилян