Interoperability between Java and Javascript Ed25519 implementations -

both ed25519-java , js-nacl have implementation of ed25519 crypto-signature methods. however, obtained public key , signed message (signed using public key's corresponding private key) ed25519-java , tried verifying signed message using public key in js-nacl. gave null value i.e. signed message not opened public key.

my question is, shouldn't possible sign in java , verify signature in javascript? if so, or if not, why?

the java code:

public static void main(string[] args) {     byte[] privatekey = new byte[32];     arrays.fill(privatekey, (byte) 0);     byte[] publickey = ed25519.publickey(privatekey);     byte[] signature = ed25519.signature("www.example.com".getbytes(), privatekey, publickey);     system.out.println("signature: " + base64.encodebase64urlsafestring(signature) + "\npublickey: " + base64.encodebase64urlsafestring(publickey));     try{         system.out.println("verification: " + ed25519.checkvalid(signature, "www.example.com".getbytes(), publickey));     } catch (exception e){         system.out.println(e.getstacktrace());     } } 

the checkvalid call returns true.

the output signature: ofmu_mc_zzzcjp2c-utqsyuhoylusnwirjbhcdkstnj2ni_p-vgkaqn5bfmpkskyiwvyiughwu3s4oyb9wbkdg

the output public key: o2onvm62pc1io6jqkm8nc2uyfxcd4komosbioytz2ik

the javascript code:

var signature = "ofmu_mc_zzzcjp2c-utqsyuhoylusnwirjbhcdkstnj2ni_p-vgkaqn5bfmpkskyiwvyiughwu3s4oyb9wbkdg"; var pk = "o2onvm62pc1io6jqkm8nc2uyfxcd4komosbioytz2ik";  var nacl_factory = require('js-nacl'); var nacl = nacl_factory.instantiate(); var b64 = require('urlsafe-base64'); var x = nacl.crypto_sign_open(uint8array(b64.decode(signature)), uint8array(b64.decode(pk))); response.send(x); 

x null, should give "www.example.com" output if signature opened public key.

not sure if impacts working, java's byte arrays signed, whereas js-nacl uses javascript's uint8array unsigned byte arrays.

ed25519 implementations differ in 2 ways:

1. the private key format bit different. work expanded private key, others ask both seed , public key when signing. java implementation falls in latter category.

   this difference applies signing function, not verification function. doesn't cause problems you.

2. some implementations use "signature box", signing returns concatenation of signature , message (signedmessage.length = 64 + message.length). when verifying expect signed message input. original nacl implementation , javascript implementation fall in category.

   some implementations return 64 byte signature. expect plaintext separate parameter when verifying. java implementation falls in category.

   this mismatch causing trouble. fix need pass concat(signature, message) crypto_sign_open.

you should read brian warner's ed25519 keys article more detailed explanation.