Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

If the underlying data is public albeit hashed with SHA-512, does that make a difference on the strength of ed25519? Please quantify the extent.

Can ed25519 be cracked after a certain amount of known signatures? If so, please quantify the conditions.

share|improve this question
    
You mean if the hash ($h(m)$) of the data is public or the data ($m$) itself? –  rath Feb 14 at 14:59
    
Thank you for looking rath! The data, public key, and signature are public, signatures are created by hashes of the data and the private key (presumed held private), and the verifier must hash the data oneself. The implementation I'm using seems to suggest it's indestructible, if I'm reading it correctly. ed25519.cr.yp.to/ed25519-20110926.pdf I'm beyond noob, so what do I know? –  Cincinnatus Feb 14 at 15:17
add comment

1 Answer 1

up vote 4 down vote accepted

No, this does not weaken ed25519 in any way. Known plaintext will not have any effect on a signature algorithm, if it did it would make that algorithm completely useless.

share|improve this answer
    
There are signature algorithms with either a strictly limited number of signatures (typical hash signatures) or which get weaker as more signatures are generated. –  CodesInChaos Feb 17 at 10:31
    
@CodesInChaos You're right, though the only algorithm like that I can think of is Lamport, which is explicitly a one time signature algorithm and is usually noted as such. And that is weakened not by known plain text but by what is essentially your key being published as part of the signature if I recall correctly. –  ultramancool Feb 18 at 12:40
1  
Even with say RSA-PSS, the security gets weaker as you get more hashes to target in a second pre-image attack. For example if you had a 128 bit hash and generated $2^{30}$ signatures, creating a fake would only cost $2^{90}$ operations. Now we generally use hashes with are twice as wide as the security level, so this is not a practical concern, but it demonstrates that this issue isn't as trivial as it seems. –  CodesInChaos Feb 18 at 13:25
    
@CodesInChaos Are you saying that it is beneficial to hash the message first? –  Cincinnatus Feb 26 at 4:59
1  
@Gracchus No, don't pre-hash the message before passing it to Ed25519. Ed25519 already hashes the message, but in a way that's stronger than a normal hash. My example of additional signatures weakening the scheme is rather theoretical. My point is just that you can't make a generalized statement like ultraman's, you need to consider the specific scheme. –  CodesInChaos Feb 26 at 8:51
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.