KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#dsh #dsh-plugin #ai-agents #developer-tools #codex #claude-code #mcp #rust #deepseek-harness #typescript #ai-agent #cli

ed25519consensus

★ 52 Open GitHub ↗

Go Ed25519 suitable for use in consensus-critical contexts.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Ed25519 for consensus-critical contexts

This library provides an Ed25519 implementation with validation rules intended
for consensus-critical contexts.

Ed25519 signatures are widely used in consensus-critical contexts (e.g.,
blockchains), where different nodes must agree on whether or not a given
signature is valid.  However, Ed25519 does not clearly define criteria for
signature validity, and even standards-conformant implementations are not
required to agree on whether a signature is valid.

Different Ed25519 implementations may not (and in practice, do not) agree on
validation criteria in subtle edge cases.   This poses a double risk to the use
of Ed25519 in consensus-critical contexts.  First, the presence of multiple
Ed25519 implementations may open the possibility of consensus divergence.
Second, even when a single implementation is used, the protocol implicitly
includes that particular version's validation criteria as part of the consensus
rules.  However, if the implementation is not intended to be used in
consensus-critical contexts, it may change validation criteria between releases.

For instance, the initial implementation of Zcash consensus in zcashd inherited
validity criteria from a then-current version of libsodium (1.0.15). Due to a
bug in libsodium, this was different from the intended criteria documented in
the Zcash protocol specification 3 (before the specification was changed to
match libsodium 1.0.15 in specification version 2020.1.2). Also, libsodium
never guaranteed stable validity criteria, and changed behavior in a later
point release. This forced zcashd to use an older version of the library before
eventually patching a newer version to have consistent validity criteria. To be
compatible, Zebra had to implement a special library, ed25519-zebra to provide
Zcash-flavored Ed25519, attempting to match libsodium 1.0.15 exactly. And the
initial attempt to implement ed25519-zebra was also incompatible, because it
precisely matched the wrong compile-time configuration of libsodium.

This problem is fixed by [ZIP215], a specification of a precise set of
validation criteria for Ed25519 signatures.
This repository contains a fork of Go's `crypto/ed25519` package with support
for [ZIP215] verification.

Note that the ZIP215 rules ensure that individual and batch verification are
guaranteed to give the same results, so unlike `ed25519.Verify`, `ed25519consensus.Verify` is
compatible with batch verification.

[ZIP215]: https://zips.z.cash/zip-0215

ed25519consensus

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README