0
votes
0answers
47 views

Probability of an ed25519 selective forgery?

What is the expected number of trials required to selectively forge ed25519? Please include how it is calculated.
2
votes
1answer
154 views

Non-standard signature security definition conforming ed25519 malleability

According to the paper “High-speed high-security signatures”… Malleability. We also see no relevance of "malleability" to the standard definition of signature security. Aside from the example, ...
2
votes
1answer
68 views

Is ed25519 a “hash signature”

Writing my last question, I saw the hash-signature tag. I tried to research it best I could, but I'm simply overwhelmed in this field. I don't think it means to simply hash data before signing, but ...
1
vote
0answers
47 views

Is this the proper way to generate an Ed25519 signing key? If not, how?

In the test of this Java implementation of Ed25519, the signing key is generated this way: byte[] sk = new byte[32]; Arrays.fill(sk, (byte)0); Is that correct? ...
1
vote
1answer
343 views

Is Curve25519-java secure?

I have only about 2 weeks of cryptography experience mostly in the form of questions on bitcoin.se. Is Curve25519-java up to date with current Curve25519 standards? Is Curve25519 itself secure? ...
4
votes
1answer
213 views

What signature schemes allow recovering the public key from a signature?

It seems to be possible to retrieve the (public) key used for creating an ECDSA signature just from the signature alone. This seems like an interesting property; as far as I know, RSA doesn't share ...
3
votes
3answers
647 views

Is it possible to pick your Ed25519 public key?

Is it possible to generate an Ed25519 keypair that has a very similar public key as another keypair (fooling a casual visual comparison) or is this as hard as solving one of SHA-512 or the discrete ...