Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently discovered the Curve25519 key exchange lib and the Ed25519 signature lib. Due to the speculations about NIST-designed curves, there is a chance that I ditch them and use the curves above instead.

If I take the curve parameters from these two libs and use them in ECDH/ECIES and ECDSA respectively, will it be safe? If yes, is it as safe as if I used Ed25519 directly?

share|improve this question
up vote 3 down vote accepted

ECDH is the same as what Curve25519 uses mathematically. The issue is that converting Curve25519 into Weierstrauß form is a bad idea, because it introduces issues relating to the potential failure of the addition law, which are difficult to address well. Keeping the curve in Montgomery or twisted Edwards form finesses these difficulties.

ECDSA has issues related to randomness and is slow. It will be secure, but Ed25519 has many advantages; especially with batch verification.

share|improve this answer
What should possible is using Weierstrass for the API, but converting to edwards for computation. – CodesInChaos Oct 11 '13 at 7:58
By "potential failure of the addition law" what do you mean exactly ? – Ruggero Dec 11 '14 at 9:19
The formulas found in books often don't work for rare cases of certain points. – Watson Ladd Mar 15 '15 at 23:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.