I recently discovered the Curve25519 key exchange lib and the Ed25519 signature lib. Due to the speculations about NIST-designed curves, there is a chance that I ditch them and use the curves above instead.

If I take the curve parameters from these two libs and use them in ECDH/ECIES and ECDSA respectively, will it be safe? If yes, is it as safe as if I used Ed25519 directly?


ECDH is the same as what Curve25519 uses mathematically. The issue is that converting Curve25519 into Weierstrauß form is a bad idea, because it introduces issues relating to the potential failure of the addition law, which are difficult to address well. Keeping the curve in Montgomery or twisted Edwards form finesses these difficulties.

ECDSA has issues related to randomness and is slow. It will be secure, but Ed25519 has many advantages; especially with batch verification.

| improve this answer | |
  • $\begingroup$ What should possible is using Weierstrass for the API, but converting to edwards for computation. $\endgroup$ – CodesInChaos Oct 11 '13 at 7:58
  • $\begingroup$ By "potential failure of the addition law" what do you mean exactly ? $\endgroup$ – Ruggero Dec 11 '14 at 9:19
  • $\begingroup$ The formulas found in books often don't work for rare cases of certain points. $\endgroup$ – Watson Ladd Mar 15 '15 at 23:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.