AWS kms documentation change

Service: kms · 2026-04-19 · Documentation low

File: kms/latest/developerguide/symm-asymm-choose-key-spec.md

Summary

Updated NIST FIPS 186-5 section references for EdDSA signature algorithms and added clarification about double hashing behavior for ED25519_PH_SHA_512 algorithm

Security assessment

The change updates technical specifications to reference correct NIST FIPS sections and clarifies cryptographic implementation details about double hashing. This improves documentation accuracy for security-relevant cryptographic operations but doesn't indicate a security vulnerability fix.

Diff

diff --git a/kms/latest/developerguide/symm-asymm-choose-key-spec.md b/kms/latest/developerguide/symm-asymm-choose-key-spec.md
index 091ad2f42..5fd195f46 100644
--- a//kms/latest/developerguide/symm-asymm-choose-key-spec.md
+++ b//kms/latest/developerguide/symm-asymm-choose-key-spec.md
@@ -228,2 +228,2 @@ ECC_SECG_P256K1 | ECDSA_SHA_256 | NIST FIPS 186-4, Section 6.4, ECDSA signature
-ECC_NIST_EDWARDS25519 | ED25519_SHA_512 | NIST FIPS 186-5, Section 7, EdDSA signature using the curve specified by the key and SHA-512 for the message digest. KMS requires [`MessageType:RAW`](https://docs.aws.amazon.com/kms/latest/APIReference/API_Sign.html#KMS-Sign-request-MessageType) with this algorithm.  
-ECC_NIST_EDWARDS25519 | ED25519_PH_SHA_512 | NIST FIPS 186-5, Section 7, EdDSA signature using the curve specified by the key and SHA-512 for the message digest. KMS requires [`MessageType:DIGEST`](https://docs.aws.amazon.com/kms/latest/APIReference/API_Sign.html#KMS-Sign-request-MessageType) with this algorithm.  
+ECC_NIST_EDWARDS25519 | ED25519_SHA_512 | NIST FIPS 186-5, Section 7.6, EdDSA signature using the curve specified by the key and SHA-512 for the message digest. KMS requires [`MessageType:RAW`](https://docs.aws.amazon.com/kms/latest/APIReference/API_Sign.html#KMS-Sign-request-MessageType) with this algorithm.  
+ECC_NIST_EDWARDS25519 | ED25519_PH_SHA_512 | NIST FIPS 186-5, Section 7.8, HashEdDSA signature using the curve specified by the key and SHA-512 for the message digest. KMS requires [`MessageType:DIGEST`](https://docs.aws.amazon.com/kms/latest/APIReference/API_Sign.html#KMS-Sign-request-MessageType) with this algorithm. When you specify the ED25519_PH_SHA_512 signing algorithm with `MessageType:DIGEST`, AWS KMS still performs the SHA-512 prehash described in [Step 1 of Section 7.8.1](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf#page=39). This means the input is hashed twice: once by you and once by KMS.