Message Signing

[SebastienGllmt]

EDIT: This has now been standardized as a Cardano Improvement Proposal. See cardano-foundation/CIPs#27

[storojs72]

@SebastienGllmt, we have summarized our tasks for Message Signing and Encryption audit:

1. To evaluate security of algorithm defined in 'Public key based encryption' section. More precisely, to evaluate usage of ephemeral Diffie-Hellman protocol;
2. To evaluate security of encryption/decryption protocol from https://github.com/Emurgo/yoroi-frontend/blob/737595fec5a89409aacef827d356c9a1605515c0/docs/specs/code/ENCRYPT.md (used on 3d step of 'Public key based encryption');
3. To evaluate concrete cryptographic primitives - that they are not weak;
4. ... actually, not sure about list completeness.

[SebastienGllmt]

@storojs72

1. Yes this is correct. Notably we also need to make sure no possible input can lead to leakage of information about the private key (even in client-side)
2. The ENCRYPT.MD specification was already previously audited independently from its use in this context.
3. Yes but I would try and avoid going down a rabbit hole on this (ex: assume Extended ED25519 as a primitive is correct and that BIP39 generation is correct since both of these have been previously audited)
4. The use of unprotected is safe (a man-in-the-middle modifying these always results in an error or invalid structure when processed downstream)