The libsodium documentation contains a function
crypto_sign_ed25519_pk_to_curve25519 that converts an Ed25519 key into a Curve25519 one, so it can be used for both key exchange/encryption and signing:
"Ed25519 keys can be converted to Curve25519 keys, so that the same key pair can be used both for authenticated encryption (crypto_box) and for signatures (crypto_sign)."
The same page ends "Notes: If you can afford it, using distinct keys for signing and for encryption is still highly recommended."
My question is whether reusing an Ed25519 keypair for both uses has been proven secure anywhere, for example in the sense of Joint Security of Encryption and Signature or a similar paper?
The two constructions seem to be:
- EdDSA signature (i.e. "Schnorr signature done properly")
- Ephemeral DH key exchange using a one-time keypair on the sender side and the recipient's public key (mapped to Curve25519).
Both involve a one-time ephemeral keypair and a hash function, I'm fine with the random oracle model (so we can assume the EdDSA nonce, which is actually a function of the key and message, is really random) and one can get domain separation by including a separation tag in the key exchange, i.e. when Alice wants to send a file to Bob whose public key is
Q, she picks a pair
(r, r.P) and sets the key as
k = H(r.Q, "this is a key not a signature") or something similar.
Intuitively this should be fine in the random oracle model; has someone actually (dis)proved it though?