# Can a properly implemented ed25519 private key with public underlying data be cracked?

If the underlying data is public albeit hashed with SHA-512, does that make a difference on the strength of ed25519? Please quantify the extent.

Can ed25519 be cracked after a certain amount of known signatures? If so, please quantify the conditions.

-
You mean if the hash ($h(m)$) of the data is public or the data ($m$) itself? –  rath Feb 14 at 14:59
Thank you for looking rath! The data, public key, and signature are public, signatures are created by hashes of the data and the private key (presumed held private), and the verifier must hash the data oneself. The implementation I'm using seems to suggest it's indestructible, if I'm reading it correctly. ed25519.cr.yp.to/ed25519-20110926.pdf I'm beyond noob, so what do I know? –  user7024 Feb 14 at 15:17

## 1 Answer

No, this does not weaken ed25519 in any way. Known plaintext will not have any effect on a signature algorithm, if it did it would make that algorithm completely useless.

-
There are signature algorithms with either a strictly limited number of signatures (typical hash signatures) or which get weaker as more signatures are generated. –  CodesInChaos Feb 17 at 10:31
@CodesInChaos You're right, though the only algorithm like that I can think of is Lamport, which is explicitly a one time signature algorithm and is usually noted as such. And that is weakened not by known plain text but by what is essentially your key being published as part of the signature if I recall correctly. –  ultramancool Feb 18 at 12:40
Even with say RSA-PSS, the security gets weaker as you get more hashes to target in a second pre-image attack. For example if you had a 128 bit hash and generated $2^{30}$ signatures, creating a fake would only cost $2^{90}$ operations. Now we generally use hashes with are twice as wide as the security level, so this is not a practical concern, but it demonstrates that this issue isn't as trivial as it seems. –  CodesInChaos Feb 18 at 13:25
@CodesInChaos Are you saying that it is beneficial to hash the message first? –  user7024 Feb 26 at 4:59
@Gracchus No, don't pre-hash the message before passing it to Ed25519. Ed25519 already hashes the message, but in a way that's stronger than a normal hash. My example of additional signatures weakening the scheme is rather theoretical. My point is just that you can't make a generalized statement like ultraman's, you need to consider the specific scheme. –  CodesInChaos Feb 26 at 8:51