5 ms·

Ah ok I see what you are saying. My bad. Totally agree with your main point of "tokens, like passwords, should be kept discrete."

• tptacek 5y ago
  Tokens are secrets. Passwords are secrets. Ed25519 private keys are secrets. We hash passwords. Thus we must hash tokens. Should we therefore hash our Ed25519 private keys?
  • ezekg 5y ago
    > Should we therefore hash our Ed25519 private keys? No, but I'm of the opinion that you should encrypt private keys before storing them in a database.
    • tptacek 5y ago
      What about the key that decrypts the private keys?
      • cpach 5y ago
        Encrypt that one too! Chelonia all the way down.
  • some_furry 5y ago
    Isn't there a weird attack possible with publishing SHA512 hashes of Ed25519 private keys that Signify barely side-stepped?