Repository navigation
Allow creating hedged EdDSA signatures? #424
Description
The current specification of EdDSA, in RFC 8032 (which we refer to), defines Ed25519 and Ed448 as being deterministic.
WebKit's implementation of Ed25519, when using macOS's CryptoKit, produces hedged (non-deterministic) signatures as per draft-irtf-cfrg-det-sigs-with-noise, citing security benefits.
So, we may want to allow this as well in the spec.
This is a copy of WICG/webcrypto-secure-curves#28, to keep track of that issue after we archive WICG/webcrypto-secure-curves.
Activity
ChALkeR commentedon Mar 16, 2026
also cc @panva and @paulmillr here
@twiss whatever language is used to allow that in the spec, it should not encourage (or even allow?) RNG -> k, it should require hedged nonces per that draft.
And Chromium will need their Boring to implement hedged for this I think
Also #163 is related (which likely should also switch to hedged, not deteministic)
[-]Allow creating randomized EdDSA signatures?[/-][+]Allow creating hedged EdDSA signatures?[/+]