Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

EdDSA sign and verify #69

Open
mattcollier opened this issue Apr 25, 2018 · 0 comments
Open

EdDSA sign and verify #69

mattcollier opened this issue Apr 25, 2018 · 0 comments

Comments

@mattcollier
Copy link

mattcollier commented Apr 25, 2018

Making another run at #58

Here is a first draft of an implementation that uses the RequestSigner API as a patch to request: request/request@master...digitalbazaar:httpSign

I found that it was necessary to duplicate much of the code involved in generating the signing string. I hopeful that we can figure out a way to improve on this situation.

The show stopper at the moment is the lack of support for eddsa algorithm here: https://github.com/joyent/node-http-signature/blob/master/lib/utils.js#L13-L17

And there does not appear to be any support for custom verifiers which would allow one to validate an EdDSA signature. Even if one would roll their own verification code, there is still a need to specify the proper algorithm.

I'm hoping to start a conversation about how to make this module more extensible generally. Some goals:

  • a way to implement signers/verifiers that does not involve reimplementing header/signing string boilerplate in other libs
  • a way to extend the available signing/verification algorithms

Why EdDSA? Here's some informal benchmarking that shows that ed25519 signing is much faster that RSA 2048. https://github.com/digitalbazaar/crypto-bench

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant