CC2642R: EDDSA driver support for partial verification

Hi Mehul,

The EDDSA driver does not support partial verification yet. We recommend to use the SHA2 driver instead.

With respect to RFC 8032 that defines Ed25519 and Ed448, we can consider using Ed25519ph, where the ph stands for prehash. Here, instead of signing all 300KB of the message, we hash the 300 KB message to a 512-bit SHA512 digest and sign that. To verify this, we again use the 300 KB message hash.

The SHA2 Hardware can only support 65k bytes of length at a time. You should call the addData function on the SHA2 driver passing in only 65,535 bytes at a time. You can loop over the 300kB data input calling addData until all data has been hashed. The output hash will then be provided to the EDDSA driver.

Here is the algorithm.This is a variation of EDDSA that is closer to Ed25519ph. The only difference is that we do not have a context or input octet string for the hash. Based on the example code in EDDSA.h, this is how I would do update preHashedMessage and preHashedMessageLength for use in EDDSA with an extremely large message. Note that we are choosing the inputs to the EDDSA driver rather than modifying the EDDSA driver. Let us assume we have a very large messageIn with corresponding messageInLength.

            SHA2_addData(sha2Handle,
                         messageIn,
                         messageInLength); //Limit to 64 KB
            
            SHA2_addData(sha2Handle,
                         messageIn,        //2nd chunk of 64 KB
                         messageInLength); //Limit to 64 KB    
            
            ... //Add data in chunks of 64 KB, could be done iteratively
            
            SHA2_finalize(sha2Handle,
                          preHashedMessage); // Store the SHA2 digest to preHashedMessage
            
            preHashedMessageLength = 64; // 512 bits is 64 bytes

Now, we are signing and verifying the SHA-512 digest of the 300 KB data. There are no known collision attacks on SHA-512, so it is expected that even finding a collision for this EDDSA implementation will take 2**256 operations for a simple collision. If we wanted to do a pre-image attack to forge a message with the same digest, this would take 2**512 operations. Both of these are infeasible with today’s technology.

Best regards,