Commit 7c0b42ba0c8a52018ad6c5c498786bc560fcc50c | zig

author	Andrew Kelley <andrew@ziglang.org> 2026-01-09 09:38:44+01:00
committer	Andrew Kelley <andrew@ziglang.org> 2026-01-09 09:38:44+01:00
log	7c0b42ba0c8a52018ad6c5c498786bc560fcc50c
tree	bcccdeb8ecddccc508b1b9f4de4695c1c3627514
parent	27039a014c591aff8ab50fd3e757a803bc116e8e
parent	cd8f0aa4ca174ae1d43232d20f27120bcd74e71f

Merge pull request 'crypto.ed25519.Signer: get an std.io parameter rather than entropy' (#30736) from jedisct1/zig:edsigned into master

Reviewed-on: https://codeberg.org/ziglang/zig/pulls/30736
Reviewed-by: Andrew Kelley <andrew@ziglang.org>

1 files changed, 23 insertions(+), 11 deletions(-)

lib
- std
  - crypto
    25519
    ed25519.zig

lib/std/crypto/25519/ed25519.zig+23-11

 @@ -385,15 +385,15 @@ pub const Ed25519 = struct {
             );
         }
-        /// Create a Signer, that can be used for incremental signing.
+        /// Create a signer that can be used for incremental signing, using a custom base nonce.
-        /// Note that the signature is not deterministic.
+        /// `base_nonce` must be unique for each signed message; otherwise, the secret key can
-        pub fn signer(
+        /// be trivially recovered by an attacker.
+        /// It can be generated using a cryptographically secure random number generator.
+        pub fn signerWithBaseNonce(
             key_pair: KeyPair,
-            /// If set, should be something unique for each message, such as a
+            base_nonce: [32]u8,
-            /// random nonce, or a counter.
+            /// If set, should be something unique for each message, such as a counter.
             noise: ?[noise_length]u8,
-            /// Filled with cryptographically secure randomness.
-            entropy: *const [noise_length]u8,
         ) (IdentityElementError || KeyMismatchError || NonCanonicalError || WeakPublicKeyError)!Signer {
             if (!mem.eql(u8, &key_pair.secret_key.publicKeyBytes(), &key_pair.public_key.toBytes())) {
                 return error.KeyMismatch;
 @@ -401,7 +401,7 @@ pub const Ed25519 = struct {
             const scalar_and_prefix = key_pair.secret_key.scalarAndPrefix();
             var h = Sha512.init(.{});
             h.update(&scalar_and_prefix.prefix);
-            h.update(entropy);
+            h.update(&base_nonce);
             if (noise) |*z| {
                 h.update(z);
             }
 @@ -411,6 +411,20 @@ pub const Ed25519 = struct {
             return Signer.init(scalar_and_prefix.scalar, nonce, key_pair.public_key);
         }
+        /// Create a Signer, that can be used for incremental signing.
+        /// Note that the signature is not deterministic.
+        pub fn signer(
+            key_pair: KeyPair,
+            /// If set, should be something unique for each message, such as a
+            /// random nonce, or a counter.
+            noise: ?[noise_length]u8,
+            io: std.Io,
+        ) (IdentityElementError || KeyMismatchError || NonCanonicalError || WeakPublicKeyError)!Signer {
+            var base_nonce: [32]u8 = undefined;
+            io.random(&base_nonce);
+            return key_pair.signerWithBaseNonce(base_nonce, noise);
+        }
     };
     /// A (signature, message, public_key) tuple for batch verification
 @@ -748,9 +762,7 @@ test "signatures with streaming" {
     const io = std.testing.io;
     const kp = Ed25519.KeyPair.generate(io);
-    var entropy: [Ed25519.noise_length]u8 = undefined;
+    var signer = try kp.signer(null, io);
-    io.random(&entropy);
-    var signer = try kp.signer(null, &entropy);
     signer.update("mes");
     signer.update("sage");
     const sig = signer.finalize();