11
$\begingroup$

Can curve25519 keys be used with ed25519?

I'd prefer to use ed25519, but there isn't a fast java version. For my application, I'd like to use curve25519 until I can get a faster ed25519 for java.

At the very least can the curve25519 keys be restricted if some can be converted ed25519?

Improve this question
$\endgroup$
2
  • 1
    $\begingroup$ The problem is that you don't get the y part of the coordinate when using a montgomery ladder to compute the public key. $\endgroup$
    – CodesInChaos
    Jan 22, 2014 at 20:26
  • $\begingroup$ This question appears to be off-topic since it turns out it’s more about asking for reference recommendations regarding Java libraries/implementations, instead of cryptography as defined in the help center. The fact that answers point to different libraries underlines this. Note: asking for reference recommendations related to libraries (including crypto-libs) are on-topic at SoftwareRecommendations.SE $\endgroup$
    – e-sushi
    Aug 4, 2014 at 4:02

2 Answers 2

Reset to default
13
$\begingroup$

Trevor Perrin wrote a library doing exactly that. Explanation can be found on in the curves mailing list archives.

To convert a Curve25519 public key $x_C$ into an Ed25519 public key $y_E$, with a Ed25519 sign bit of $0$: $$y_E = \frac{x_C - 1}{x_C + 1} \mod 2^{255}-19$$ The Ed25519 private key may need to be adjusted to match the sign bit of $0$: if multiplying the Curve25519 private key by the Ed25519 base point yields a “negative” Ed25519 x-coordinate, then the private key must be negated modulo the order of the base point: $a_E = q - a_C$.

See Trevor Perrin's email and the ensuing thread for a security analysis.

Improve this answer
$\endgroup$
0
5
$\begingroup$

AFAIK, no. However, Ed25519 keys can be converted to Curve25519 keys. My Ed25519 library supports this (or well, it supports DH with Ed25519 keys).

Whether it is secure to use the same key for both signing and Diffie-Hellman, I don't exactly know. This answer suggests that it is very likely, but it still needs more study.

Improve this answer
$\endgroup$
9
  • $\begingroup$ Thank you nightcracker! I think I either have to use Curve25519 at this point or another digital signature algorithm unless if you can help with this. Thank you so very very much in advance! crypto.stackexchange.com/questions/12949/… $\endgroup$
    – user7024
    Jan 22, 2014 at 20:42
  • 1
    $\begingroup$ @Gracchus I think you should look into using a C library from Java - there are almost no cryptographers writing libraries in Java. $\endgroup$
    – orlp
    Jan 22, 2014 at 21:08
  • $\begingroup$ Thank you nightcracker! I've noticed. ;)) I do appreciate your help! $\endgroup$
    – user7024
    Jan 22, 2014 at 21:33
  • 2
    $\begingroup$ @nightcracker Come again? Sun JCE, PKCS11 & JSSE + ECC. Then there are Bouncy Castle, IAIK libraries, BSAFE... If you want support for a specific curve, ask on the Bouncy mailing list! Or add it yourself of course! $\endgroup$
    – Maarten Bodewes ♦
    Jan 23, 2014 at 15:21
  • $\begingroup$ @owlstead Sorry, I meant the cryptographers that develop the primitives themselves - they almost never release a Java library. There are a few "cryptography suites" as you've cited, that implement many primitives, but outside of those big suites there isn't much high-quality Java cryptography software available. This means that if you want to use modern cryptography, like Ed/Curve25519, ChaCha, Keccak, BLAKE, Poly1305, that you'll either have to implement it yourself or trust an often badly performing non-scrutinized third-party implementation. $\endgroup$
    – orlp
    Jan 24, 2014 at 8:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy