RustCrypto / RustCrypto/signatures
Unclear Docs - Which `sign()` to use?
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 661
- Forks
- 196
- Avg merge
- 1h 45m
- Merged PRs (30d)
- 1
Description
Reading the docs for a SigningKey there are a number of Signing traits. These include Signer, RandomizedSigner, PrehashSigner, RandomizedDigestSigner, DigestSigner.
The issue it's that the docs aren't clear on how these fit together, or the security properties. The classing being the private key recovery of the ps3 due to lack of randomisation in signatures, but this crate doesn't seem to indicate that an rng is needed during try_sign() with the Signer trait or the DigestSigner variant.
The docs should be clearer about what is the right trait to use - especially since there are potential security issues with using the wrong one.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the SigningKey documentation and the Signer, RandomizedSigner, PrehashSigner, RandomizedDigestSigner, and DigestSigner trait definitions. Compare their signing inputs, RNG expectations, and security properties. Done means the docs clearly explain which trait to use in each situation and the risks of choosing the wrong one.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- cryptography, documentation
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100