Why does EdDSA use the (SHA-512) hash of the secret key as the exponent for the public key rather than using the secret key value directly? This seems inefficient, and I can't see how it adds any extra security.
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
1
Ed25519 needs two secret values:
- The private scalar (~256 bits)
- A hash prefix used derive a secret nonce from the message (256 bits)
Using the same value for these is bad style, as is deriving one of them from the other. You could also use their concatenation as private key, but that'd double its size to 512 bits. So Ed25519 chose the clean solution of deriving both from a 256 bit master secret.
answered Jun 30, 2015 at 9:25
-
$\begingroup$ Thanks. That makes sense. I'd overlooked the deterministic nonce. I suppose that "using the same value for these is bad style" means that there isn't a known attack but using the same key gives us an uneasy feeling? The security of the actual approach and (hypothetically) using the same value would seem to rest on the infeasibility of computing a SHA512 pre-image? $\endgroup$– geoff_hJun 30, 2015 at 10:13