About the security review:
Putting:
s is the public key for signing
Z is the context data (signer public key or certificate, etc)
Original:
m = hash(Z, message)
x = hash(m, s)
keygen25519(Y, NULL, x);
h = m XOR hash(Y);
sign25519(v, h, x, s);
output (v,r) as the signature
Nxt:
Z is omitted
m = hash(message);
x = hash(m, s);
keygen25519(Y, null, x);
h = hash(m, Y);
Curve25519.sign(v, h, x, s);
output (v,h) as the signature
Is the question whether the change from h = m XOR hash(Y) to h = hash(m, Y) is risking the security?
Or what is the real question?
The question: Is NRS crypto algo strong enough?
