Signatures over Ristretto

[chm-diederichs]

We are interested in implementing a signature scheme using ristretto keypairs, so that we may to safely incorporate key tweaking operations into our protocols.

You have such a scheme implemented in wasm-crypto. Comparing with the AssemblyScript implementation, it seems that all of the necessary group operations have already been implemented in libsodium, it would just be a case of writing the high level API in a crypto_sign_ristretto255 module analogous to crypto_signs implementation.

Is there something we are overlooking that means this API is not suitable for libsodium? We'd be happy to contribute time and effort to the process, but we thought to first check your thoughts on this approach.

[jedisct1]

Is there a standard way to create signatures over ristretto255?

The closest we have seems to be Polkadot's sr25519.

There's an implementation in C here: https://github.com/TerenceGe/sr25519-donna

Maybe it can be adapted to use libsodium instead of internal implementations of ristretto255 and sha2 (but doesn't Polkadot use Blake2b?)

As all the required functions are in the public libsodium API, this can be a standalone project. Or maybe a contribution to sr25519-donna as a compile-time option.

[chm-diederichs]

Is there a standard way to create signatures over ristretto255?

Not that I could find. I was looking at the Ristretto signature scheme from wasm-crypto which is a Schnorr scheme as far as I can tell? However, I understand that wasm-crypto is likely more opinionated than Libsodium.

Thank you for the links, I'll take a look at the options you suggest. Most probably a standalone project is the way we'll go.