0
$\begingroup$

EdDSA generates the private nonce deterministically by hashing the private key and the message, and this means that the public nonce $r$ and the signature s will be same if the same message signed more than once.

Does this mean that EdDSA is vulnerable to replay attacks? I know it is not, but I don't know what the mechanisms are that EdDSA uses to avoid this type of attacks.

$\endgroup$
1
  • $\begingroup$ Please edit the question if a clarification is requested. $\endgroup$
    – Maarten Bodewes
    Mar 18 at 1:36

1 Answer 1

4
$\begingroup$

Does this mean that EdDSA is vulnerable to Reply attack ? I now it is not, but I don't what are the mechanisms that EdDSA uses to avoid this type of attacks.

Well, for any signature system, if an attacker gets a (message, signature) pair, they could try to use it multiple times, and the signature would validate each time. This would be termed a "replay attack", and there's nothing special about EdDSA with this. Hence, if the application needs to protect against this, it needs to add additional protection beyond what the signature mechanism gives you, be it a liveness proof, a time stamp, or what not.

Of course, some applications do not care about "replay attacks". For example, if I (as a software developer) release the latest version of my software with my signature (to prove that it's the image as I published it), I don't care if someone generates a bit-for-bit identical copy of the image and signature.

$\endgroup$
2
  • 2
    $\begingroup$ Thus EdDSA is no more and no less vulnerable to replay attack than any signature system. And it prescribes no mechanism to avoid these. Common mechanisms to avoid replay of signatures (when that's needed) include having an horodate in the signed message, or better a challenge generated by the intended receiver. $\endgroup$
    – fgrieu
    Mar 17 at 8:00
  • $\begingroup$ @poncho , I got it, thanks a lot. But please, Are there any research that mentions the information that you wrote (Hence, if the application needs to protect against this, it needs to add additional protection beyond what the signature mechanism gives you, be it a liveness proof, a time stamp, or what not.) ? $\endgroup$ Mar 18 at 7:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.