Native Ed25519 signatures in Safari are non-deterministic

[paulmillr]

README says:

The Web Incubator Community Group has advocated for the addition of Ed25519 support to the Web Crypto API, and support has already landed in most modern JavaScript runtimes.

Does this look like "most modern JavaScript runtimes"?

• Safari implements signatures with noise (which no one else does) instead of RFC 8032
  • Allow creating randomized EdDSA signatures? WICG/webcrypto-secure-curves#28
  • Document that Safari generates randomized Ed25519 signatures mdn/browser-compat-data#24462
  • https://bugs.webkit.org/show_bug.cgi?id=262499
  • https://mailarchive.ietf.org/arch/msg/cfrg/U14Y3pkfAORaF-pQGB_iGHNqY7Q/
  • https://datatracker.ietf.org/doc/draft-irtf-cfrg-det-sigs-with-noise/
• Largest marketshare engine (Chrome-based browsers) have it behind a flag

[steveluscher]

Thank you for the pointer about Safari.

// Repro
(async () => {
  const { privateKey } = await crypto.subtle.generateKey("Ed25519", false, [
    "sign",
    "verify",
  ]);
  const message = new Uint8Array([1, 2, 3]);
  console.log(
    'A', new Uint8Array(await crypto.subtle.sign("Ed25519", privateKey, message))
  );
  console.log(
    'B', new Uint8Array(await crypto.subtle.sign("Ed25519", privateKey, message))
  );
  console.log(
    'C', new Uint8Array(await crypto.subtle.sign("Ed25519", privateKey, message))
  );
})();

[steveluscher]

Can you say a bit more about what problem randomized signatures would create?

[paulmillr]

They are actually better and more secure, however, no one uses them, which could create compat issues. Even the spec has no test vectors

[steveluscher]

…which could create compat issues.

Which issues could you imagine?

[paulmillr]

1. Double spending may be possible if same msg is signed multiple times. This happened in XMR
2. Test vectors for "signing" would fail. Maybe some integration tests?

Overall verifier doesn't know whether signature was deterministic or not, so they would not be able to distinguish those.

[steveluscher]

Got it. Solana doesn't use a transaction's signature to prevent double-spending, so hedged signatures won't present a problem there.

Thanks for the discussion! Good to see you again.

[github-actions]

Because there has been no activity on this issue for 7 days since it was closed, it has been automatically locked. Please open a new issue if it requires a follow up.