# Tag Info

11

Clearing the lower 3 bits of the secret key ensures that is it a multiple of 8, which in turn ensures that no information, small as it may be, about the secret key is leaked in the case of an active small-subgroup attack. The typical simple Diffie-Hellman key exchange works like this: $$\text{Alice} \xrightarrow{\hspace{3cm} a G \hspace{3cm}} \text{Bob} ... 9 If I understand your question correctly, you are essentially asking if points in Edwards and Montgomery curves can be represented in Weierstrass coordinates. This is true; in fact, any elliptic curve over a prime field can be represented in Weierstrass form \mathcal{E}_{w}^{a, b} : y^2 = x^3 + ax + b, and by extension its points can too. The question, ... 7 First off, your equation is correct and there seems to be no calculation mistake. To understand on how to get from$$(2+d)x^{2}+dy^{2}=d+(d-2)x^{2}y^{2}$$to$$x^{2}+y^{2}=1+e\cdot x^{2}y^{2}$$one first needs to observe that e=(d-2)/(d+2)=121665/121666 holds. The next step is to consider: "What operations are actually allowed with birational ... 7 Trevor Perrin wrote a library doing exactly that. Explanation can be found on in the curves mailing list archives. To convert a Curve25519 public key x_C into an Ed25519 public key y_E, with a Ed25519 sign bit of 0:$$y_E = \frac{x_C - 1}{x_C + 1} \mod 2^{255}-19$$The Ed25519 private key may need to be adjusted to match the sign bit of 0: if ... 6 Well, lets go through the issues: It seems to be possible to retrieve the (public) key used for creating an ECDSA signature just from the signature alone Nope, not quite. You also need the message being signed. And, with that, it doesn't give you the unique public key; it does allow you to narrow it down to two possibilities (assuming you're using a ... 6 You could try the 112-bit secp112r1 cited in [1]. Before you do this, the problem with that paper is they actually show how to break the discrete log problem on this curve! And this was back in 2012. So any export-strength implementation of ECC is definitely breakable by governments, research groups and sufficiently determined/resourceful commercial ... 5 All of these are answered by the SafeCurves project: x^2 + y^2 \equiv 1 + dx^2y^2 \pmod p Edwards curves can be converted to Montgomery form.Montgomery curves can be converted to Weierstrass form.Some, but not all, Weierstrass curves can be converted to Montgomery form. The Montgomery ladder (applicable only to Edwards and Montgomery curves) is faster ... 5 If you can store the private key with some pre-computed work, then you can pick almost any public key you want. So in a way, it depends on the implementation. Here's a diagram of how Ed25519 works, note how keys are generated: (Image source.) A more detailed description (that is simpler than the actual paper) of the process is in these slides (slides 9 ... 5 Any key generation algorithm for any cryptosystem is going to be weak if the attacker can predict what seed was used to generate the key. They can just generate the same key. However, assuming the the random number generator is not that bad, different algorithms start to look different. If you are just using the output of the random number generator as a ... 5 How many qubits are required for breaking RSA 2048 and RSA 4096 in real-time with a quantum computer? Like the answer you linked to shows, about \log(N^2) = 2 \log(N). So 4096 for 2048-bit RSA, double that for 4096-bit. This paper (pdf) has an algorithm using 2n+3 qubits, where n=\log N. How many qubits are required to break ... 4 The core of the problem is finding a near first pre-image on the function A = aB on an elliptic curve, where A is the public key, and a the private key¹. For a normal hash function you  2^m  operations to fix m specific bits.² In particular a full pre-image takes  2^n  hash function calls. A full pre-image on A = aB is equivalent to solving ... 4 ge_scalarmult_base returns GroupElementP3 which doesn't have (x, y) as members. It has X, Y, Z from which you can compute x = X / Z and y = Y / Z. So you have two choices: Compress the point with ge_tobytes: byte[32] Abytes; fe y; ge_scalarmult_base(&A,sk); ge_tobytes(Abytes, &A); fe_frombytes(&y, Abytes); // your code here using y ... 4 Edwards curves have unified addition so adding a point to itself returns the correct result. This differs from Weierstrass curves, where adding a point to itself gives the wrong result and you must use doubling. So your expectation that addition and doubling should return the same point is correct. High performance implementations of ECC use some form of ... 4 In the usual definition of security of Elliptic Curves, curve25519 security is in fact 126 bits. If look at safecurves's rho page you can see the rho complexity for curve25519 is 2^{125.8} in accordance to what you say. Curve25519 author basically doesn't accept that definition of security. In the Curve25519 paper he states in section 1: Every known ... 4 Assuming this is the paper you're talking about, your modification completely eliminates resilience to collisions in the underlying hash function H. The EdDSA scheme (and in the Schnorr scheme on which it is based) is highly resilient against collisions in H. Specifically, in the generic group model, the Schnorr scheme has been proven to be secure even ... 4 No, Curve25519 signature is not vulnerable to bad RNG during signature generation; that's because Curve25519 signature needs no random number during signature generation. By contrast, in ECDSA, a fresh random number is needed for each signature, and if it gets known, that allows to recover the private key from the signature and public key; same if the same ... 4 Ed25519 is well-defined and requires you to use SHA-512 as internal hash function along with the twisted Edwards version of Curve25519, hence there's no need for a KAC when it comes to questions about the parameters. As for the integrity of the public key, there's not yet a standard for Ed25519 based certificates so there would be a custom solution needed ... 3 Peter Schwabe, one of the authors of Ed25519, directed me to a recent paper titled "EdDSA for more curves". The section "Security notes on prehashing", page 5, says that the Ed25519 algorithm without prehashing the message is resistant to collisions in the hash function, while using the algorithm with prehashing is not. Of course the hash function is not ... 3 1. The equation -x^2+y^2=1-(121665/121666)x^2y^2 defining the curve E is quadratic in x, hence for any given y\in\mathbb F_q, there are at most two points on E which have y as their second coordinate. In this case, the two possible x-coordinates for a point on E with y-coordinate 4/5\in\mathbb F_q are the solutions to the equation$$ ...

3

No, this does not weaken ed25519 in any way. Known plaintext will not have any effect on a signature algorithm, if it did it would make that algorithm completely useless.

3

Threshold (robust) m-of-n variant of Schnorr signature scheme is known: Douglas R. Stinson, Reto Strobl - Provably Secure Distributed Schnorr Signatures and a (t, n) Threshold Scheme for Implicit Certificates Major hints on intended usage are from Ripple page mentioned. Points 4 and 3 are explicit: produce a signature, in a theshold m-of-n way. This could ...

3

To perform an Ed25519 signature operation, you need to know three values, denoted by $\sf RH$, $a$ and $A$ in the diagram. Now, as it happens, these values are not independent: $A$ can be derived from $a$, and both $\sf RH$ and $a$ can be derived from the seed $k$. Thus, all you really need to store is the seed $k$; everything else can be derived from ...

3

ECDH is the same as what Curve25519 uses mathematically. The issue is that converting Curve25519 into Weierstrauß form is a bad idea, because it introduces issues relating to the potential failure of the addition law, which are difficult to address well. Keeping the curve in Montgomery or twisted Edwards form finesses these difficulties. ECDSA has issues ...

3

AFAIK, no. However, Ed25519 keys can be converted to Curve25519 keys. My Ed25519 library supports this (or well, it supports DH with Ed25519 keys). Whether it is secure to use the same key for both signing and Diffie-Hellman, I don't exactly know. This answer suggests that it is very likely, but it still needs more study.

3

Curve25519 makes use of a special x-coordinate only form to achieve faster multiplication. Ed25519 uses Edwards curve for similar speedups, but includes a sign bit. While it could have been done differently, doing it this way simplifies implementations that only need one of encryption or signing.

3

Proofs of Storage (PoS) are challenge-response protocols that allow a client to verify that a server is truthfully storing a file. See this paper from Ateniese, Kamara and Katz for an example of PoS. The basic idea is explained in this quote from that paper: Viewing the file $\vec f$ as an $n$-dimensional vector, the client begins by tagging each ...

2

Ed25519 or more general the EdDSA (Edwards-curve Digital Signature Algorithm) approach can be considered as a variant of ElGamal signatures (such as Schnorr or DSA). They all are signatures following the hash-then-sign approach. This simply means that you can sign arbitrary length messages by hashing them to a constant size string using a secure ...

2

Related to Curve25519 Curve25519 seems to be secure so far. Yet, you have to remind yourself that Dr. Bernstein specified Curve25519 for key-exchange. Meaning: key-generation, transaction signing, and verification are somewhat different beasts – you might want to cross-check on that before jumping toward Curve25519. Sure, Curve25519-java supports signing… ...

2

PLEASE NOTE: The code I link to below has not yet been reviewed by anyone with professional cryptography experience. I expect that it contains bugs, and it is definitely not production-ready. I am still learning about the JCA; there are parts of the code I have not finished, and there are parts that I will most likely go back and redo. That said, the tests ...

Only top voted, non community-wiki answers of a minimum length are eligible