6
$\begingroup$

From TLS 1.3 there are two signature algorithms using edDSA:

      /* EdDSA algorithms */
      ed25519(0x0807),
      ed448(0x0808),

All the other signature-schemes provide hash information, for example:

ecdsa_secp256r1_sha256 => sha256

rsa_pkcs1_sha384 => sha384

How can I determine when receiving edDSA signature algorithm which hash to use?

Is there any default value for each one of them?

Improve this question
$\endgroup$
1
  • 2
    $\begingroup$ It's already defined as a part of those signing algorithms, and any existing implementation will use the correct standardized one for each of those two $\endgroup$
    – Natanael
    Commented Feb 26, 2019 at 13:52

2 Answers 2

Reset to default
11
$\begingroup$

If you follow the references in RFC 8446, you'll see that it cites RFC 8032 for the definition of the EdDSA-based algorithms. RFC 8032 in turn tells you all the details about the hash functions and other parametrization—field, curve equation, base point, encoding, signature equation, etc.—of EdDSA for Ed25519 and Ed448.

There are several roles for a hash function involved in RFC 8032: a prehash (peculiar to RFC 8032, added in order to placate users of shoddy designs that invite DoS attacks), a key-derivation hash, a per-signature pseudorandomization hash, and a message hash.

Ed25519 uses SHA-512 for all these purposes; Ed448 uses SHAKE256. But none of these choices concern you as a user of Ed25519 or Ed448: The choice of hash functions is a part of the signature scheme itself, not a parameter chosen or computed by a user.

The other signature methods in TLS are relics from days of yore when it was common to present users with a dizzying array of acronym soup options: Which mathematical magic do you want to use like RSA ($s \equiv h^e \pmod n$), ECDSA ($r \equiv x([h s^{-1}]G + [r s^{-1}]A]) \pmod p$), etc.; and separately, how do you want to be vulnerable to collisions in computing $h$ from a message $m$ like MD5, SHA-1, etc.? This era gave us delightfully nonsensical names like md5WithRSAEncryption (a.k.a. 1.2.840.113549.1.1.4) for signature schemes.

The modern approach is to use a short name Ed25519 for a complete signature scheme on messages providing 128-bit security against existential unforgeability under adaptive chosen message attack, with all knobs and parameters and bells and whistles decided for you. An implementation of Ed25519 or Ed448 operates on bit strings of arbitrary length and structure, and does all of this hashing internally—in fact, it's not even defined in terms of a fixed hash $H(m)$ of a message; instead it's defined in terms of a pseudorandom function $H(k, m)$ of the message where $k$ is part of the secret key.

Improve this answer
$\endgroup$
2
  • $\begingroup$ So if I understand it right, when verifying a signature of Ed25519 as a client, there's no need for computation of the hash in advance? Instead, the context together with the secret is sent to the function and it's internally computed with the signing itself? $\endgroup$
    – Martin
    Commented Feb 27, 2019 at 7:50
  • $\begingroup$ @SilentBash Correct. In fact, Ed25519 doesn't even involve $\operatorname{SHA512}(m)$ per se at all. Rather, it involves $\operatorname{SHA512}(k \mathbin\| m)$, where $k$ is part of the long-term secret key, and $\operatorname{SHA512}(R \mathbin\| A \mathbin\| m)$, where $R$ is half of the signature and $A$ is the public key. $\endgroup$
    – Squeamish Ossifrage
    Commented Feb 27, 2019 at 7:52
13
$\begingroup$

Hash algorithms:

$^1$ SHAKE-256 is a SHA-3 algorithm, a subgroup of the "Keccak" family.

Improve this answer
$\endgroup$
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.