- Ed25519 is a signature or just elliptic curve?
- EDDSA is signature, what using curve ed25519?
$\begingroup$
$\endgroup$
0
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
2
Your short answer is this: ed25519 is both a signature scheme and a use case for Edwards-form Curve25519. EDDSA generalises this signature scheme to any curve in edwards form (for example Ed448-Goldilocks, Curve41417).
Curve25519 first arrived in 2005-2006 (https://cr.yp.to/ecdh/curve25519-20060209.pdf), a few years before the Edwards Normal form papers on Elliptic Curves. Montgomery curves, the form of curve used for Curve25519, was originally used to speed up elliptic curve factorization (https://cr.yp.to/bib/1987/montgomery.pdf). The original proposal for Curve25519 was for use as a diffie hellman (key exchange) protocol. This is still its use and is now often called X25519.
Later, Edwards came up with his own form of elliptic curve (http://www.ams.org/journals/bull/2007-44-03/S0273-0979-07-01153-6/S0273-0979-07-01153-6.pdf). DJB, Tanja et al researched these forms and realised they too were fast, especially for signatures and we got Ed25519 (https://ed25519.cr.yp.to/ed25519-20110926.pdf) using the Edwards form of Curve25519. This was later generalised to EDDSA (https://ed25519.cr.yp.to/eddsa-20150704.pdf) so that other curves could be used with the scheme.
So, so far we have the following nomenclature:
- Curve25519, Curve41417, Ed448-Goldilocks: generally the name of the curve itself, however it was originally presented (bear in mind they're often presented alongside use cases to justify them, like "it's fast").
- X25519, X448, X41417 - DH key exchange schemes using the above curve.
- EDDSA, Ed25519, Ed448 - the first being the generic Edwards variant of DSA, plus other fixes, the others being specific instances matched to their curve names.
Confusingly, Open Whisper Systems came up with XEdDSA (https://whispersystems.org/docs/specifications/xeddsa/). To quote them:
XEdDSA enables use of a single key pair format for both elliptic curve Diffie-Hellman and signatures.
Hence, I suppose "X EdDSA" is taken to mean "exchange and EdDSA" of the given curve. In this instance, the key exchange part still happens using the montgomery form of the curve, but the signature part (eddsa) uses the same curve in edwards form.
As pointed out by Kostas Chalkias in the comments, the X may in fact be a reference to the use of the x-coordinate in curve25519. X25519 is performed on the kummer line, which is a fancy mathematical way to say that it suffices to know the x-coordinate to compute the scalar multiplication necessary for X25519 key exchange.
-
1$\begingroup$ >> I suppose "X EdDSA" is taken to mean "exchange and EdDSA". It's not clear if this true, X was probably chosen because it's convenient to use the encoding of the 𝑥 coordinate of a point on Curve25519 for key exchange, hence the name X25519. $\endgroup$ Commented Sep 18, 2019 at 17:06
-
$\begingroup$ @KostasChalkias that's a very good point actually, didn't think of that. $\endgroup$– diagprovCommented Sep 20, 2019 at 20:55
$\begingroup$
$\endgroup$
EdDSA is a digital signature scheme.
As defined in RFC 8032: Ed25519 is an instantiation of EdDSA with the twisted Edwards curve edwards25519. So Ed25519 is also digital signature scheme.
edwards25519 curve is birationally equivalent to Curve25519. Meaning that you can transform a point $(u,v)$ of Curve25519 to a point $(x,y)$ of the curve edwards25519 with the transformation:
$x = \frac{u}{v}\sqrt{-486664}, \quad y = \frac{u - 1}{u + 1}.$
