lithdew / ed25519-donna-zig Goto Github PK

This is an issue that this package is inheriting from donna, but:

• Batch verification is flaky and will produce both positive and negative results for a given batch depending on the random scalars chosen.
• Batch verification will succeed for batches that contain signatures that would fail non-batch verification.

The simple solution to get correct and consistent behavior is to alter donna's single and batch verification routines to use the equations that include the cofactor multiply(s), but depending on how well you want your library to interoperate exactly with other implementations, this may not be feasible.

See section 3.2 of https://eprint.iacr.org/2020/1244.pdf for a more detailed explanation of the problem.