Tag Info

Hot answers tagged

8

Clearing the lower 3 bits of the secret key ensures that is it a multiple of 8, which in turn ensures that no information, small as it may be, about the secret key is leaked in the case of an active small-subgroup attack. The typical simple Diffie-Hellman key exchange works like this: $$ \text{Alice} \xrightarrow{\hspace{3cm} a G \hspace{3cm}} \text{Bob} ...


4

Well, lets go through the issues: It seems to be possible to retrieve the (public) key used for creating an ECDSA signature just from the signature alone Nope, not quite. You also need the message being signed. And, with that, it doesn't give you the unique public key; it does allow you to narrow it down to two possibilities (assuming you're using a ...


4

If you can store the private key with some pre-computed work, then you can pick almost any public key you want. So in a way, it depends on the implementation. Here's a diagram of how Ed25519 works, note how keys are generated: (Image source.) A more detailed description (that is simpler than the actual paper) of the process is in these slides (slides 9 ...


4

No, this does not weaken ed25519 in any way. Known plaintext will not have any effect on a signature algorithm, if it did it would make that algorithm completely useless.


3

The paper itself has more details on this: ECDSA, like many other signature systems, asks users to generate not merely a random long-term secret key, but also a new random secret session key $r$ for each message to be signed. ... If the same value r is ever used for 2 diff erent messages the secret key can be computed as well, as ElGamal... It ...


3

Edwards curves have unified addition so adding a point to itself returns the correct result. This differs from Weierstrass curves, where adding a point to itself gives the wrong result and you must use doubling. So your expectation that addition and doubling should return the same point is correct. High performance implementations of ECC use some form of ...


3

AFAIK, no. However, Ed25519 keys can be converted to Curve25519 keys. My Ed25519 library supports this (or well, it supports DH with Ed25519 keys). Whether it is secure to use the same key for both signing and Diffie-Hellman, I don't exactly know. This answer suggests that it is very likely, but it still needs more study.


3

To perform an Ed25519 signature operation, you need to know three values, denoted by $\sf RH$, $a$ and $A$ in the diagram. Now, as it happens, these values are not independent: $A$ can be derived from $a$, and both $\sf RH$ and $a$ can be derived from the seed $k$. Thus, all you really need to store is the seed $k$; everything else can be derived from ...


3

The core of the problem is finding a near first pre-image on the function $A = aB$ on an elliptic curve, where $A$ is the public key, and $a$ the private key¹. For a normal hash function you $ 2^m $ operations to fix $m$ specific bits.² In particular a full pre-image takes $ 2^n $ hash function calls. A full pre-image on $A = aB$ is equivalent to solving ...


3

ECDH is the same as what Curve25519 uses mathematically. The issue is that converting Curve25519 into Weierstrauß form is a bad idea, because it introduces issues relating to the potential failure of the addition law, which are difficult to address well. Keeping the curve in Montgomery or twisted Edwards form finesses these difficulties. ECDSA has issues ...


2

ge_scalarmult_base returns GroupElementP3 which doesn't have (x, y) as members. It has X, Y, Z from which you can compute x = X / Z and y = Y / Z. So you have two choices: Compress the point with ge_tobytes: byte[32] Abytes; fe y; ge_scalarmult_base(&A,sk); ge_tobytes(Abytes, &A); fe_frombytes(&y, Abytes); // your code here using `y` ...


2

Ed25519 is a specific implementation of EdDSA using the Twisted Edwards curve: x^2 + y^2 = 1 + (121665/121666) * (x^2)(y^2) It's known as high speed high security signature algorithm. For using the code you pointed out, you need to feed sk, pk, m, sm. So first you need to call publickey function with sk, then call signature function with m, sk and pk. PK ...


2

PLEASE NOTE: The code I link to below has not yet been reviewed by anyone with professional cryptography experience. I expect that it contains bugs, and it is definitely not production-ready. I am still learning about the JCA; there are parts of the code I have not finished, and there are parts that I will most likely go back and redo. That said, the tests ...


2

Ed25519 or more general the EdDSA (Edwards-curve Digital Signature Algorithm) approach can be considered as a variant of ElGamal signatures (such as Schnorr or DSA). They all are signatures following the hash-then-sign approach. This simply means that you can sign arbitrary length messages by hashing them to a constant size string using a secure ...


1

Unless I am missing something, I believe that you can simply compute $R = s*B - h*A$ using point subtraction.


1

The results should be the same as you have noted. Although I would think that most people would have a function more akin to ScalarMult(int, point) instead of dbl. Perhaps you could look at dbl and check if it is really a doubling function. Another check you could perform is to look at the $x$-coordinates of either outputs. Are they the same? If only the ...


1

Almost every Java .valueOf(byte[] s, int offset, int length) has the same meaning: s is the array to read from. offset is the location in the array to start reading from (inclusive). length is the number of bytes to try and read - "try" because the array may not be long enough to have that many bytes from offset. Remembering that Java arrays are ...


1

There was review of Java implementation https://gist.github.com/doctorevil/9521116 and the authour thinks it's safe


1

Ed25519 in the default implementation is malleable. It includes the public key $A$ in the hashed message, so it cannot be modified It includes $R$ in the hashed message, so it cannot be modified $S$ is encoded as a 256 bit. But since it's a scalar, $S^\prime = S + k \cdot l$ is equivalent to $S$ for any integral $k$ (where $l$ is the order of the subgroup, ...


1

Looking at the Ed25519 paper, it seems that a key pair consists of a private key $k$ (just a $k$-bit string) and a public key $A$, where $A = a · B$ and $a$ is derived from the first half of the hash $H(k)$ ($B$ is the base point of an elliptic curve (or actually a twisted Edwards curve equivalent to an elliptic curve) and $·$ is the scalar multiplication in ...



Only top voted, non community-wiki answers of a minimum length are eligible