[openpgp] Re: pure vs. pre-hash in FIPS 204 and 205

[Justus Winter <[e-mail]>]

Hi Falko :)

thanks for the explanation.  I think I understand now.

Falko Strenzke <[e-mail]> writes:

>> On the other hand, if OpenPGP were to use the HashEdDSA variant, we'd
>> compute:
>>
>>    sig = PureEdDSA(PH(Hash(OpenPGP_Hash_Stream)))
>>                       ^ This happens in OpenPGP
>>                    ^ This is the prehash in HashEdDSA
>>
>> Which seems not ideal.
>
> This is the point of the misunderstanding. There is no double hashing.
> PH(OpenPGP_Hash_Stream) is the only hash that happens.

I see.  I guess what contributed to my misunderstanding this is that
PH(OpenPGP_Hash_Stream) seems impossible to implement: it combines
hashing and signing into one operation, breaking both OpenPGP's model
and every existing implementation, therefore, I guess I concluded that
PH(Hash(OpenPGP_Hash_Stream)) is the only conceivable way to implement
this.

For the record, Nettle only implements PureEdDSA.  I can see that the
implementation seems to be extensible to HashEdDSA, but this has to be
done in the library (i.e. cannot be done by a consumer), and it would
require a different kind of interface for signature creation and
verification where you can stream the data into.

I see that Botan has that kind of streaming interface, but the Rust
bindings do not export a streaming interface.  I haven't looked at other
libraries.

So circling back to your original question, I believe that for
implementers requiring a signing algorithm of the pre-hashed variant is
a major burden.  Even if all the cryptographic libraries would support
the pre-hash variant with a suitable streaming interface (which they
don't for EdDSA), we'd have to stuff the signing/verification algorithm
into places where we up to now only have hash algorithms.  It is not
that it couldn't be done, but since it breaks the mold, it is a hassle.


Best,
Justus