# Can a properly implemented ed25519 private key with public underlying data be cracked?

If the underlying data is public albeit hashed with SHA-512, does that make a difference on the strength of ed25519? Please quantify the extent.

Can ed25519 be cracked after a certain amount of known signatures? If so, please quantify the conditions.

-
You mean if the hash ($h(m)$) of the data is public or the data ($m$) itself? – rath Feb 14 '14 at 14:59
Thank you for looking rath! The data, public key, and signature are public, signatures are created by hashes of the data and the private key (presumed held private), and the verifier must hash the data oneself. The implementation I'm using seems to suggest it's indestructible, if I'm reading it correctly. ed25519.cr.yp.to/ed25519-20110926.pdf I'm beyond noob, so what do I know? – user7024 Feb 14 '14 at 15:17

Even with say RSA-PSS, the security gets weaker as you get more hashes to target in a second pre-image attack. For example if you had a 128 bit hash and generated $2^{30}$ signatures, creating a fake would only cost $2^{90}$ operations. Now we generally use hashes with are twice as wide as the security level, so this is not a practical concern, but it demonstrates that this issue isn't as trivial as it seems. – CodesInChaos Feb 18 '14 at 13:25