At wolfSSL we have had customers asking us whether we support the Ed25519 signature algorithm using a hash. We are pleased to announce that we now have available all the signature algorithms in RFC8032 including the prehashed version.
The original Ed25519 signature algorithm, much to the consternation of hardware vendors, has the message being hashed twice - with different prefixes. Signing large messages is therefore bad news for hardware accelerators as the whole message has to be sent rather than a small hash as in RSA and ECDSA.
The designers of the algorithm did this for security reasons. But, the IETF came out with a backward compatible algorithm that hashes the message with SHA-512 first. From RFC8032, the ed25519ph algorithm is: “greatly more vulnerable to weaknesses in hash functions used”. Therefore it should be used with caution.
The other algorithm adds a context that is prepended to the hashed data. But there are also security considerations when using this algorithm. The context should be a fixed value that is not message dependent and all uses in the protocol should use contexts if one of them does. If an attacker can choose the prefix, then this opens up an attack vector where they can try different prefixes until they get the result they want. Using a context in one place and not another has a similar problem.
For more information about wolfSSL, its supported algorithms, or other questions, please contact facts@wolfssl.com.