ed25519-zebra

[burdges]

Are we using the prehashed variant of ed25519 anyplace? If not, then we should replace ed25519-dalek with ed25519-zebra, which better supports batch verification.

Ain't clear if ed25519-zebra ever wants features not required by zcash, so maybe we should do something else if we use the prehashed variant of ed25519 somewhere. I once pointed @tomaka to its existence

[burdges]

Related lib https://github.com/hdevalence/ed25519consensus for the Go implementation

[burdges]

We never use the prehashed variant in substrate or polkadiot according to grep -r --include "*.rs" _prehashed . so..

We should go ahead and switch to ed25519-zebra whenever convenient.

[tomaka]

If I understand correctly, ed25519-zebra is a slightly-non-standard flavour of ed25519 that is more strict (and thus better)?

[burdges]

It's less strict and thus better. :)

[stale]

Hey, is anyone still working on this? Due to the inactivity this issue has been automatically marked as stale. It will be closed if no further activity occurs. Thank you for your contributions.

[burdges]

It's being worked on..

[gilescope]

Is this something the other polkadot implementations will also want to switch over to? (i.e. should there be some linked issues?)

[burdges]

Yes! We definitely need all implementations to migrate to an equivalent ed25519. It's straightforward to modify an ed25519 to be equivalent, just multiply by the cofactor when checking the verification equation. Thanks for bringing this up.

[burdges]

We still need this, which requires updating #8764.

We now need to understand the difference between ed25519-zebra and ed25519-consensus, which forked after 3 Dec 2020 --- commit ZcashFoundation/ed25519-zebra@0e7a96a

https://github.com/penumbra-zone/ed25519-consensus/commits/main
https://github.com/ZcashFoundation/ed25519-zebra/commits/main

I'm personally inclined to stick with zebra because zcash is a more established player. Also, we switched schnorrkel back off curve25519-dalek-ng recently, non-ng has many open issues & pulls https://github.com/dalek-cryptography/curve25519-dalek/issues but at least it has them so everyone knows the status of things.

[burdges]

We'll stick with ed25519-zebra so #8764 needs to be updated.