Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add new keytype-scheme for prehash ? #310

Open
udf2457 opened this issue Jan 14, 2025 · 0 comments
Open

Add new keytype-scheme for prehash ? #310

udf2457 opened this issue Jan 14, 2025 · 0 comments

Comments

@udf2457
Copy link

udf2457 commented Jan 14, 2025

I was scrolling back throuh the TUF Slack recently and found an interesting discussion[1][2] related to using compute-constrained hardware tokens (e.g. Yubikeys) for signing.

TL;DR The discussion pointed out that there was a limitation, both in terms of processing power and in terms of input bytes as to how much a Yubikey would accept, e.g. it was stated that on YubiHSM it was limited to the size of one message to the YubiHSM, i.e. 2019 bytes.

It could therefore perhaps be useful in this context to formally enable support in the specification for pre-hash modes of signing, e.g. Ed25519ph and others.

There are other hardware keys out there, e.g. Tilitis TKey which by definition can support any algorithm, including Ed25519ph, but you would still be limited to the processing-power and perhaps input size too.

[1] https://cloud-native.slack.com/archives/C8NMD3QJ3/p1719216361044959
[2] https://cloud-native.slack.com/archives/C8NMD3QJ3/p1719229551933119

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant