using Org.BouncyCastle.Crypto.Parameters;

using Org.BouncyCastle.Crypto.Signers;

using System.Security.Cryptography;

using System.Text;

using Org.BouncyCastle.Math.EC.Rfc8032;

using Org.BouncyCastle.OpenSsl;

using System;

using System.IO;

​

class Program

{

    static void Main(string[] args)

    {

        // test evctor for Ed25519ph from RFC8032, section 7.3 

        string ed25519pkcs8 = @"-----BEGIN PRIVATE KEY-----

                    MC4CAQAwBQYDK2VwBCIEIIM/5iQJI3udYux3WHUgkR6adZzsHRl1W32pAbltyj1C

                    -----END PRIVATE KEY-----";

        PemReader pemReaderPrivate = new PemReader(new StringReader(ed25519pkcs8));

        Ed25519PrivateKeyParameters privateKey = (Ed25519PrivateKeyParameters)pemReaderPrivate.ReadObject();

        Ed25519PublicKeyParameters publicKey = privateKey.GeneratePublicKey();

        byte[] message = Encoding.UTF8.GetBytes("abc");

        byte[] preHashedMessage = SHA512.HashData(message);

​

        {

            byte[] signature = SignEd25519ph(privateKey, message, new byte[0]);

            bool isValid = VerifyEd25519ph(publicKey, message, signature, new byte[0]);

            Console.WriteLine(Convert.ToHexString(signature));

            Console.WriteLine(isValid);

        }

        {

            byte[] signature = SignEd25519phLowLevel(privateKey, preHashedMessage, new byte[0]);

            bool isValid = VerifyEd25519phLowLevel(publicKey, preHashedMessage, signature, new byte[0]);

            Console.WriteLine(Convert.ToHexString(signature));

            Console.WriteLine(isValid);

        }

    }

​

    static byte[] SignEd25519ph(Ed25519PrivateKeyParameters privateKey, byte[] message, byte[] context)

    {

        var signer = new Ed25519phSigner(context); 

        signer.Init(true, privateKey);

        signer.BlockUpdate(message, 0, message.Length);

        return signer.GenerateSignature();

    }

​

    static bool VerifyEd25519ph(Ed25519PublicKeyParameters publicKey, byte[] message, byte[] signature, byte[] context)

    {

        var verifier = new Ed25519phSigner(context); 

        verifier.Init(false, publicKey);

        verifier.BlockUpdate(message, 0, message.Length);

        return verifier.VerifySignature(signature);

    }

​

    static byte[] SignEd25519phLowLevel(Ed25519PrivateKeyParameters privateKey, byte[] preHashedMessage, byte[] context)

    {

        byte[] signature = new byte[64];

        privateKey.Sign(Ed25519.Algorithm.Ed25519ph, new byte[0], preHashedMessage, 0, preHashedMessage.Length, signature, 0);

        return signature;

    }

​

    static bool VerifyEd25519phLowLevel(Ed25519PublicKeyParameters publicKey, byte[] preHashedMessage, byte[] signature, byte[] context)

    {

        return publicKey.Verify(Ed25519.Algorithm.Ed25519ph, new byte[0], preHashedMessage, 0, preHashedMessage.Length, signature, 0);

    }

}