7
$\begingroup$

I'm interested exploring key derivation and threshold signature protocol that require point arithmetic (addition) on the private scalar values and $S$ values of the signatures in .

Specifically what I would like to be able to do

  1. Generate two eddsa private keys: (pub_1,key_1), (pub_2,key_2)
  2. Compute the private scalar for each. key_1 -> exp_key_1 , key2 -> exp_key_2
  3. Convert the keys to ed25519 points. exp_key_1 -> pt_1, exp_key_2 ->pt_2
  4. Add the points to each other to get a third point. pt_1 + pt_2 -> pt_3
  5. The sum of the points multiplied by the base point is expected to equal sum of the original public keys. Knowing how to convert the sum of the points to the base point would also be nice pt_3 * G == pub_1 + pub_2

The part of the this process that is least clear to me is step 3.

The ref10 code makes it easy to do point arithmetic on public key. Just decode and do the add point addition as per question “Point addition and doubling in Ed25519 (ref10)?”

Using the raw bytes to Point decoder on the scalar fails about half the time and when it succeeds the expected homomorphisms don't hold; i.e.: $(a+b)\times G == A+B$

I'm aware the libsecp256k1 makes these sorts of manipulations very easy. I think it would be useful to be that on curve25519.

Improve this question
$\endgroup$
4
  • $\begingroup$ The scalar multiplication routines in Ref10 set the most significant bit of the scalar to 1, which interacts badly with computed scalars. You need to remove those masking code lines. $\endgroup$
    – CodesInChaos
    Oct 11, 2015 at 18:35
  • $\begingroup$ I believe the masking code you refering to is "expandedSecretKey[0] &= 248 expandedSecretKey[31] &= 63 expandedSecretKey[31] |= 64". Removing that doesn't seem to improve to situation situation with secretKey to Point conversion. $\endgroup$
    – zmanian
    Oct 11, 2015 at 19:07
  • $\begingroup$ Then please clarify your question and include what you're doing and what the expected result is. $\endgroup$
    – CodesInChaos
    Oct 11, 2015 at 19:14
  • $\begingroup$ I'll give it a try. $\endgroup$
    – zmanian
    Oct 11, 2015 at 19:16

1 Answer 1

Reset to default
1
$\begingroup$

The problem may that ed25519-donna uses a decompression that inverts points. That's fixable, but from the description of the problem I think you might be mangling the point encoding somehow, and it isn't quite clear how.

Improve this answer
$\endgroup$
2
  • $\begingroup$ Is there in function in floodberry's ed25519-donna implementation that converts a scalar to a group element? I didn't see one. Thanks! $\endgroup$
    – zmanian
    Oct 12, 2015 at 0:46
  • 1
    $\begingroup$ @zmanian Not sure what you mean by converting, but the closest analogy to such a conversion is scalar multiplication with the base point. $\endgroup$
    – CodesInChaos
    Oct 12, 2015 at 7:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.