3
$\begingroup$

I recently discovered the Curve25519 key exchange lib and the Ed25519 signature lib. Due to the speculations about NIST-designed curves, there is a chance that I ditch them and use the curves above instead.

If I take the curve parameters from these two libs and use them in ECDH/ECIES and ECDSA respectively, will it be safe? If yes, is it as safe as if I used Ed25519 directly?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
3
$\begingroup$

ECDH is the same as what Curve25519 uses mathematically. The issue is that converting Curve25519 into Weierstrauß form is a bad idea, because it introduces issues relating to the potential failure of the addition law, which are difficult to address well. Keeping the curve in Montgomery or twisted Edwards form finesses these difficulties.

ECDSA has issues related to randomness and is slow. It will be secure, but Ed25519 has many advantages; especially with batch verification.

Improve this answer
$\endgroup$
3
  • $\begingroup$ What should possible is using Weierstrass for the API, but converting to edwards for computation. $\endgroup$
    – CodesInChaos
    Oct 11, 2013 at 7:58
  • $\begingroup$ By "potential failure of the addition law" what do you mean exactly ? $\endgroup$
    – Ruggero
    Dec 11, 2014 at 9:19
  • $\begingroup$ The formulas found in books often don't work for rare cases of certain points. $\endgroup$
    – Watson Ladd
    Mar 15, 2015 at 23:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.