fix: implement BLAKE-512 as declared by the ciphersuite label - #12
Open
rdubois-crypto wants to merge 1 commit into
Open
fix: implement BLAKE-512 as declared by the ciphersuite label#12rdubois-crypto wants to merge 1 commit into
rdubois-crypto wants to merge 1 commit into
Conversation
The ciphersuite is named FROST-EDBABYJUJUB-BLAKE512-v1, but the default hash function in RFC9591Hasher was blake2b with a 64-byte digest, which is a different algorithm from BLAKE-512 (the BLAKE-1 / SHA-3 finalist). The domain-separation label therefore did not describe the hash actually in use. BLAKE-512 is also the hash the wider RAILGUN / circomlib EdDSA-on- BabyJubJub stack is built around (key pruning and nonce derivation), which is what hardware implementations validate their vectors against. Switch the default hasher to blake512 from @noble/hashes/blake1 and regenerate the H1/H3/H4/H5 test vectors for the existing fixed input. No dependency change: blake1 ships in the @noble/hashes version already pinned. Custom hashers injected via the constructor are unaffected.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The ciphersuite is named FROST-EDBABYJUJUB-BLAKE512-v1, but the default hash function in RFC9591Hasher was blake2b with a 64-byte digest, which is a different algorithm from BLAKE-512 (the BLAKE-1 / SHA-3 finalist). The domain-separation label therefore did not describe the hash actually in use.
BLAKE-512 is also the hash the wider RAILGUN / circomlib EdDSA-on- BabyJubJub stack is built around (key pruning and nonce derivation), which is what hardware implementations validate their vectors against.
Switch the default hasher to blake512 from @noble/hashes/blake1 and regenerate the H1/H3/H4/H5 test vectors for the existing fixed input. No dependency change: blake1 ships in the @noble/hashes version already pinned. Custom hashers injected via the constructor are unaffected.
Fix #10