TCNCoalition / TCN

Specification and reference implementation of the TCN Protocol for decentralized, privacy-preserving contact tracing.
MIT License
263 stars 33 forks source link

Note that implementations might not match the test vectors if Ed25519 randomization is used. #62

Open hdevalence opened 4 years ago

hdevalence commented 4 years ago

Ed25519 signatures can be deterministic, but they can also be randomized to defend against some side channel attacks. In particular, @zssz pointed out that per Apple docs the iOS implementation of Ed25519 signatures uses randomization. So there should be some note on the test vectors to point out that if the signature implementation uses randomization, the bytes of the signature may not match the test vectors, and that's fine (as long as the signature still verifies).