[openpgp] Re: pure vs. pre-hash in FIPS 204 and 205

[Daniel Huigens <[e-mail]>]

Hi Falko,

On Monday, August 26th, 2024 at 13:25, Falko Strenzke wrote:

> In order to do it compliant with RFC 8032, it would have to be done by using the HashEdDSA variant and providing the message hash from the protocol laver to the signature function as PH(M). By no means any double hashing occurs anywhere, as both you and Daniel have claimed. This probably the source of the misunderstanding, which happens when replacing the message M with Hash(M).

There is no variant in RFC 8032 that takes PH(M) and returns Ed25519ph over it. One could imagine such a construction, but it's not what RFC 8032 specifies; there, PH(M) is computed internally in Ed25519ph, not externally in the application. Note that section 5.1.6 says:

> The inputs to the signing procedure is the private key, a 32-octet
> string, and a message M of arbitrary size. For Ed25519ctx and
> Ed25519ph, there is additionally a context C of at most 255 octets and a flag F, 0 for Ed25519ctx and 1 for Ed25519ph.

Furthermore, the "rule" you've stated that the message can not itself be a hash, I can't find in RFC 8032, in fact the section 8.5 that I quoted before essentially contradicts it. Of course doing so does have security implications, but those have been considered.

Best,
Daniel