1
$\begingroup$

ECDSA can be instantiated with a variety of different elliptic curve groups.

Two example curves are secp256k1 and edwards25519.

Question: Assume we have a secret key scalar generated for secp256k1. Is it OK to use this scalar for ECDSA over edwards25519?

Improve this question
$\endgroup$
15
  • 1
    $\begingroup$ In general, we are not advising using a key for multiple purposes. If you need, have a master key and drive two keys by using a good key derivation function like HKDF. If you are using a key for more than one purpose, a simple question what if you lost the secrecy of your key ( software problems, shoulder sniff) then all of your signatures are lost! $\endgroup$
    – kelalaka
    Commented Jan 23 at 11:33
  • 3
    $\begingroup$ edwards25519 is more often associated with EdDSA than with ECDSA. These are significantly different algorithms (e.g. in EdDSA a representative of the ephemeral Elliptic Curve point is in the input of the hash, it's not in ECDSA). It's not clear to me how ECDSA on edwards25519 works (or would work). Perhaps the question is: what if we use a private key scalar intended for ECDSA on secp256k1 as one for EdDSA on edwards25519 ? Or is the question strictly with ECDSA, e.g. on secp256k1 and secp256r1 ? $\endgroup$
    – fgrieu ♦
    Commented Jan 23 at 11:54
  • 1
    $\begingroup$ @MarcIlunga The background is as follows. Assume we have a distributed key generation protocol that produces secret-shared scalars over a certain range. It is already implemented and not easy to swap out / modify. Could we use the scalars produced by the DKG in a scheme that has a slightly different curve order? $\endgroup$
    – mti
    Commented Jan 23 at 22:49
  • 1
    $\begingroup$ @mti I did indeed say before that this is an interesting question on its own right. But, I think it's fair to say that the practical motivations described earlier matter quite a bit and make the question a bit more specific. Briefly, on your first objection, I think this applicable to basically anything. For the curves in question. The DKG output is a 256-bits value, whereas the target order is 253 bits. This introduces a modulo bias and the distribution is bad. However, if the initial curve had a 512 bit order, the distribution is close to random even after reduction. $\endgroup$
    – Marc Ilunga
    Commented Jan 24 at 0:35
  • 1
    $\begingroup$ For future reference, I derived and wrote down the general closed formula for computing the modulo bias. crypto.stackexchange.com/questions/109521/… Please have a look if that checks out. @MarcIlunga $\endgroup$
    – mti
    Commented Jan 27 at 22:06

0

Reset to default

Browse other questions tagged or ask your own question.