On Thu, 10 Sep 2026 00:10:25 GMT, Weijun Wang <[email protected]> wrote:
>> src/java.base/share/man/keytool.md line 1397: >> >>> 1395: * Modern digital signature algorithms such as EdDSA and ML-DSA use >>> the same >>> 1396: name for both the key and signature algorithms. Only the signature >>> algorithm >>> 1397: with the same name can be used with a given key algorithm. The >>> specific >> >> "Only the signature algorithm with the same name can be used with a given >> key algorithm." >> >> Generally yes, but for algorithm families like EdDSA or ML-DSA, it is not >> specifically true. You can use an "Ed25519" Signature with an "EdDSA" key if >> the key itself is Ed22519. >> >> Maybe avoid using "same name" and say "algorithm" instead. "Modern digital >> signature algorithms such as EdDSA and ML-DSA use the same algorithm as the >> key." (Maybe that is all you need). > > You are right. I meant to say there is no more "SHA1with" part in the > signature name, so the `-sigalg` option is useless. Also, I think I should > not mention parameter sets at all, which could only make people confused. How > about this? > > * Modern digital signature algorithms such as EdDSA and ML-DSA use the same > algorithm as the key, and there is no separately selectable signature > algorithm > such as `SHA1withRSA`. Therefore, when using such a key, specifying `-sigalg` > explicitly is unnecessary. Looks better, but maybe it can be more concise? Suggest: Modern digital signature algorithms such as EdDSA and ML-DSA use the same algorithm as the key. When using such a key, specifying `-sigalg` is unnecessary. ------------- PR Review Comment: https://git.openjdk.org/jdk/pull/32616#discussion_r4006738892
