crypto_sign_init_first_pass, crypto_sign_update, crypto_sign_final, crypto_sign_init_second_pass, crypto_check_init, crypto_check_update, crypto_check_finalincremental public key signatures


#include <monocypher.h>
crypto_sign_init_first_pass(crypto_sign_ctx *ctx, const uint8_t secret_key[32], const uint8_t public_key[32]);
crypto_sign_update(crypto_sign_ctx *ctx, const uint8_t *message, size_t message_size);
crypto_sign_final(crypto_sign_ctx *ctx, uint8_t signature[64]);
crypto_sign_init_second_pass(crypto_sign_ctx *ctx);
crypto_check_init(crypto_check_ctx *ctx, const uint8_t signature[64], const uint8_t public_key[32]);
crypto_check_update(crypto_check_ctx *ctx, const uint8_t *message, size_t message_size);
crypto_check_final(crypto_check_ctx *ctx);


These functions are variants of crypto_sign(3monocypher) and crypto_check(3monocypher). Prefer those simpler functions if possible.
The arguments are the same as those described in crypto_sign(3monocypher).
This incremental interface can be used to sign or verify messages too large to fit in a single buffer. The arguments are the same as the direct interface described in crypto_sign(3monocypher).
The direct and incremental interface produce and accept the same signatures.
Signing is done in two passes. This requires five steps:
Verification requires three steps:


crypto_sign_init_first_pass(), crypto_sign_init_second_pass(), crypto_sign_update(), crypto_sign_final(), crypto_check_init() and crypto_check_update() return nothing.
crypto_check_final() returns 0 for legitimate messages and -1 for forgeries.


Sign a message:
uint8_t       sk       [ 32]; /* Secret key            */ 
const uint8_t pk       [ 32]; /* Public key (optional) */ 
const uint8_t message  [500]; /* Message to sign       */ 
uint8_t       signature[ 64]; /* Output signature      */ 
crypto_sign_ctx ctx; 
crypto_sign_init_first_pass((crypto_sign_ctx_abstract*)&ctx, sk, pk); 
/* Wipe the secret key if no longer needed */ 
crypto_wipe(sk, 32); 
for (size_t i = 0; i < 500; i += 100) { 
    crypto_sign_update((crypto_sign_ctx_abstract*)&ctx, message + i, 100); 
for (size_t i = 0; i < 500; i += 100) { 
    crypto_sign_update((crypto_sign_ctx_abstract*)&ctx, message + i, 100); 
crypto_sign_final((crypto_sign_ctx_abstract*)&ctx, signature);
Check the above:
const uint8_t pk       [ 32]; /* Public key         */ 
const uint8_t message  [500]; /* Message to sign    */ 
const uint8_t signature[ 64]; /* Signature to check */ 
crypto_check_ctx ctx; 
crypto_check_init((crypto_sign_ctx_abstract*)&ctx, signature, pk); 
for (size_t i = 0; i < 500; i += 100) { 
    crypto_check_update((crypto_sign_ctx_abstract*)&ctx, message + i, 100); 
if (crypto_check_final((crypto_sign_ctx_abstract*)&ctx)) { 
    /* Message is corrupted, abort processing */ 
} else { 
    /* Message is genuine */ 
This interface can be used to mitigate attacks that leverage power analysis and fault injection (glitching) – both of which require physical access and appropriate equipment – by injecting additional randomness (at least 32 bytes) and padding (to the hash function's block size, which is 128 bytes for all hash functions supported by Monocypher), of which 32 bytes are already inserted into the buffer by crypto_sign_init_first_pass(). Access to a cryptographically secure pseudo-random generator is a requirement for effective side channel mitigation. Signing a message with increased power-related side channel mitigations:
const uint8_t message  [   500]; /* Message to sign         */ 
uint8_t       sk       [    32]; /* Secret key              */ 
const uint8_t pk       [    32]; /* Public key (optional)   */ 
uint8_t       signature[    64]; /* Output signature        */ 
uint8_t       buf      [128-32] = {0}; /* Mitigation buffer */ 
crypto_sign_ctx ctx; 
crypto_sign_ctx_abstract *actx = (crypto_sign_ctx_abstract *)&ctx; 
arc4random_buf(buf, 32); 
/* The rest of buf MUST be zeroes. */ 
crypto_sign_init_first_pass(actx, sk, pk); 
crypto_sign_update         (actx, buf, sizeof(buf)); 
crypto_sign_update         (actx, message, 500); 
crypto_sign_update          (actx, message, 500); 
crypto_sign_final           (actx, signature); 
crypto_wipe(buf, 32); 
/* Wipe the secret key if no longer needed */ 
crypto_wipe(sk,  32);


crypto_blake2b(3monocypher), crypto_key_exchange(3monocypher), crypto_lock(3monocypher), crypto_sign(3monocypher), crypto_wipe(3monocypher), intro(3monocypher)


These functions implement PureEdDSA with Curve25519 and Blake2b, as described in RFC 8032. This is the same as Ed25519, with Blake2b instead of SHA-512.
The example for side channel mitigation follows the methodology outlined in I-D.draft-mattsson-cfrg-det-sigs-with-noise-02.


The crypto_sign_init_first_pass(), crypto_sign_update(), crypto_sign_final(), crypto_sign_init_second_pass(), crypto_check_init(), crypto_check_update(), and crypto_check_final() functions first appeared in Monocypher 1.1.0.
A critical security vulnerability that caused all-zero signatures to be accepted was introduced in Monocypher 0.3; it was fixed in Monocypher 1.1.1 and 2.0.4.


Messages are not verified until the call to crypto_check_final(). Messages may be stored before they are verified, but they cannot be trusted. Processing untrusted messages increases the attack surface of the system. Doing so securely is hard. Do not process messages before calling crypto_check_final().
When signing messages, the security considerations documented in crypto_sign(3monocypher) also apply. In particular, if power-related side channels are part of your threat model, note that there may still be other power-related side channels (such as if the CPU leaks information when an operation overflows a register) that must be considered.


EdDSA signatures require two passes that cannot be performed in parallel. There are ways around this limitation, but they all lower security in some way. For this reason, Monocypher does not support them.
March 31, 2020 Linux 4.15.0-106-generic