Point release for Ed25519 bug fix about tink

[thaidn]

Hi iainmcgin@,

Yes it's a known bug in the code. That's why it's annotated with @Alpha. We don't recommend using it for production.

We're working hard on 1.1.0 release, but Ed25519 might not make the cut because we're still worried about that code (it was written by a contributor).

Do you absolutely need it or can you switch to ECDSA? If you really need it, we'll spend more time working on it and that might delay the 1.1.0 release 1-2 weeks -- it's fine for us, because we have no pressure to release it now.

[thaidn]

Without Ed25519, 1.1.0 will be out in a couple of days. With Ed25519, it won't be later than 4/15/2018.

[iainmcgin]

We don't desperately need it, I just picked that scheme as it is intended to be more performant than ECDSA, according to Bernstein's paper, though I haven't actually tried benchmarking the Tink implementation to see if that is the case.

So anyway, don't rush on my account. If there are any low-hanging fruit changes needed that you'd like help with, let me know.

P.S: Hello from the outside, I left the Google Identity team a couple of months ago.

[ise-crypto]

Thanks Iain. We implemented it in pure Java, so it might not give you a better performance comparing to JCE ECDSA which I believe is a wrapper of native code. I'd love to see the numbers if you happen to benchmark it though.

Cheers!

[iainmcgin]

Oh, one last thing: I didn't realize the Ed25519 implementation was alpha, and I think a potential point of confusion there is that Ed25519 is included from the default Tink config registration. Maybe if it's not considered safe to use, it shouldn't be in the default config and users of the library should have to explicitly roll their own config to include it?

[thaidn]

Yeah it's a mistake. We're making it safe now. Stay tuned!

…

On Wed, Mar 28, 2018 at 4:45 PM, Iain McGinniss ***@***.***> wrote: Oh, one last thing: I didn't realize the Ed25519 implementation was alpha, and I think a potential point of confusion there is that Ed25519 is included from the default Tink config registration. Maybe if it's not considered safe to use, it shouldn't be in the default config and users of the library should have to explicitly roll their own config to include it? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#86 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAAdbG35Hp3pWSlE-XV1zyaxCBdW2TVQks5tjCCWgaJpZM4S9rQb> .

-- https://vnhacker.blogspot.com

[iainmcgin]

@ise-crypto I wrote a simple micro-benchmark to measure performance of signing operations for Ed25519 and ECDSA. You can see the code and results here: https://github.com/wework/tink-signature-benchmark

tl;dr: The Ed25519 implementation in Tink is almost 10x faster than the OpenJDK provided implementation of ECSDA with the P-256 curve.

[thaidn]

Thanks Iain. It's astonishing that Ed25519 is 10x faster than ECDSA. We've decided to include it in 1.1.0 and are making a few final changes. It should be ready by the end of this week. BTW we'd love to include your benchmarking code in Tink. Is it possible to convert it to Java?

…

On Tue, Apr 3, 2018 at 2:19 PM, Iain McGinniss ***@***.***> wrote: @ise-crypto <https://github.com/ise-crypto> I wrote a simple micro-benchmark to measure performance of signing operations for Ed25519 and ECDSA. You can see the code and results here: https://github.com/wework/tink-signature-benchmark — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#86 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAAdbFxt5LLaa2SxR5cCBlCYRTe9zV1pks5tk-ddgaJpZM4S9rQb> .

-- https://vnhacker.blogspot.com

[iainmcgin]

Sure, the Kotlin code isn't that fancy and should be straightforward to translate. Want me to send you a PR?

[thaidn]

Yes, please. Thanks so much Iain!

…

On Tue, Apr 3, 2018 at 2:34 PM, Iain McGinniss ***@***.***> wrote: Sure, the Kotlin code isn't that fancy and should be straightforward to translate. Want me to send you a PR? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#86 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAAdbGzztyTsG85qJWdcpZEe_0Ou8NXqks5tk-rZgaJpZM4S9rQb> .

-- https://vnhacker.blogspot.com

[thaidn]

Hey Iain, just want to make sure you see this. We released 1.2.0 with Ed25519.

[iainmcgin]

I spotted that, thanks! I'm still working with my employer to get the Google Corporate CLA signed so that I can send you a PR for the benchmarking code; hopefully that will be resolved soon.