Using sha256, sha512, ED25519ph or not

[Kleidukos]

Hi @jedisct1!

As you saw, I'm implementing a set of bindings to libsodium in Haskell, and I have a couple of questions regarding whether or not using some hashing and signing algorithms.

While sha256 & sha512 can be replaced by Blake2b, ED25519 (which is not always marked as being pre-hashed) comes with a warning in the RFC:

The Ed25519ph and Ed448ph variants are prehashed. This is mainly
useful for interoperation with legacy APIs, since in most of the
cases, either the amount of data signed is not large or the protocol
is in the position to do digesting in ways better than just
prehashing (e.g., tree hashing or splitting the data). The
prehashing also makes the functions greatly more vulnerable to
weaknesses in hash functions used. These variants SHOULD NOT be
used.

Moreover, the crypto state of Ed25519ph is based on sha512, which is also marked with a warning:

/*
 * WARNING: Unless you absolutely need to use SHA512 for interoperability,
 * purposes, you might want to consider crypto_generichash() instead.
 * Unlike SHA512, crypto_generichash() is not vulnerable to length
 * extension attacks.
 */

Is it trying to tell me that signature algorithms should be sourced from another C backend? Am I missing anything?

Thanks again for libsodium anyway, I'm very happy that it exists. :)

[jedisct1]

Ed25519ph uses SHA-512 internally, but length extensions attacks are not relevant in this context.

It's perfectly fine to use. You can also pre-hash yourself with generichash() and sign the result with regular Ed25519.

The only critical thing here is to use a collision-resistant hash function. And there's no sign that SHA-2 is going to be broken anytime soon.

[Kleidukos]

Thank you very much for the explanation! :)