diff options
| author | Taylor R Campbell <campbell+tor@mumble.net> | 2018-10-19 17:43:17 +0000 |
|---|---|---|
| committer | George Kadianakis <desnacked@riseup.net> | 2018-10-24 15:56:40 +0300 |
| commit | 3c34000c9c28b6a55e2c4333a5ad0ccf99bd4026 (patch) | |
| tree | def8e15f4cc6fc0f81c2aeee52ed272a58d5f504 /control-spec.txt | |
| parent | 8cf90bb7bfa3fc4799186d93b615be85b7828ed4 (diff) | |
| download | torspec-3c34000c9c28b6a55e2c4333a5ad0ccf99bd4026.tar.gz torspec-3c34000c9c28b6a55e2c4333a5ad0ccf99bd4026.zip | |
Specify the ED25519-V3 private key format, and explain why it is so.
Diffstat (limited to 'control-spec.txt')
| -rw-r--r-- | control-spec.txt | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/control-spec.txt b/control-spec.txt index 6f0a543..6a04b65 100644 --- a/control-spec.txt +++ b/control-spec.txt @@ -1671,8 +1671,18 @@ (The KeyBlob format is left intentionally opaque, however for "RSA1024" keys it is currently the Base64 encoded DER representation of a PKCS#1 - RSAPrivateKey, with all newlines removed. For a "ED25519-V3" key is a Base64 - encoded ed25519 private key.) + RSAPrivateKey, with all newlines removed. For a "ED25519-V3" key is + the Base64 encoding of the concatenation of the 32-byte ed25519 secret + scalar in little-endian and the 32-byte ed25519 PRF secret.) + + [Note: The ED25519-V3 format is not the same as, e.g., SUPERCOP + ed25519/ref, which stores the concatenation of the 32-byte ed25519 + hash seed concatenated with the 32-byte public key, and which derives + the secret scalar and PRF secret by expanding the hash seed with + SHA-512. Our key blinding scheme is incompatible with storing + private keys as seeds, so we store the secret scalar alongside the + PRF secret, and just pay the cost of recomputing the public key when + importing an ED25519-V3 key.] (The "NEW:BEST" option obeys the HiddenServiceVersion torrc option default value. Currently it is 2.) |