Skip to content
ecdsa.com

Pre-hash signing (HashEdDSA, HashML-DSA)

Signing a digest of the message rather than the message itself, either implicitly (ECDSA, RSA) or through explicitly separate, domain-separated variants such as Ed25519ph and HashML-DSA.
Also written asprehashHashEdDSAEd25519phHashML-DSAHashSLH-DSAexternal mu

ECDSA and RSA always sign a hash, so the data can be hashed in a stream or on another machine and an HSM only ever sees 32–64 bytes. PureEdDSA and ML-DSA instead process the whole message together with key-dependent values (EdDSA's nonce and challenge both hash the message; ML-DSA binds a hash of the public key into its message representative μ), so the entire message must reach the signer.

Pre-hash variants exist for this case: Ed25519ph and Ed448ph (RFC 8032; HashEdDSA in FIPS 186-5 §7.8), HashML-DSA (FIPS 204 §5.4) and HashSLH-DSA (FIPS 205 §10.2.2), the last two binding the hash function's OID into what is signed. They are distinct algorithms with distinct signatures, so a verifier for the pure variant rejects them. FIPS 204 also lets every ML-DSA step except generating the signing randomness run outside the signing module, which HSM interfaces use to accept a precomputed μ.

Prehashing makes security depend on the collision resistance of the hash, while pure EdDSA tolerates hash collisions. Use pure variants unless streaming or a remote signer forces otherwise, and never mix both variants under one key without domain separation (RFC 8032 §8.6; FIPS 204 recommends one variant per key).

Standards and references

All terms