The question is mainly stated in the title. We don't consider any other changes to the scheme except for the following:

We replace $S = H(R,A,M) \cdot a + r$ with $S = H(R,M) \cdot a + r$.

My thoughts are that since A is the public key, it is redundant since $a$ is still present on $S$ and $A$ is still used in the verification process, since we check:

$SB = H(R,M) \cdot A + R$

Thanks you for your time.


1 Answer 1


Including $A$ (public key) allows to achieve SBS (Strongly Binding Signature aka non-repudiation): signature is bound to the message and the public key.

That means an attacker can't produce a signature that is valid for two message-public key pairs, even when an attacker is a signer.

Very few EdDSA implementations are actually SBS: for example, RFC 8032 and FIPS 186-5 don't have proper verification rules. See page 18 of Taming the many EdDSAs

A more practical explanation is the following (quoting from here):

An algorithmic detail is that that signer's public key is involved in the deterministic computation of the S part of the signature only, but not in the R value. The latter implies that if an adversary could somehow use the signing function as an Oracle (that expects arbitrary public keys as inputs), then it is possible that for the same message one can get two signatures sharing the same R and only differ on the S part. Unfortunately, when this happens, one can easily extract the private key; this StackOverflow post post explains why this is feasible.

  • $\begingroup$ Can you elaborate more? Since $a$ (the private key) is involved in the signature creation process and since there is 1-1 relationship between private and public keys why it will remove the non repudiation property from the signature? $\endgroup$
    – tur11ng
    Commented Oct 28, 2023 at 13:48
  • $\begingroup$ The hint is in small-order public keys. See the paper, it provides extensive details. $\endgroup$ Commented Oct 28, 2023 at 16:41
  • $\begingroup$ After a lot of research I finally found this : github.com/MystenLabs/ed25519-unsafe-libs $\endgroup$
    – tur11ng
    Commented Oct 29, 2023 at 11:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.