Elliptic curve ed25519 vs ed448 - Differences

Question

Other than key size, What are some differences between the Elliptic curve ed25519 and ed448?

Answer 1

Edwards25519 is the twisted Edwards curve $$-x^2 + y^2 = 1 - (121665/121666) x^2 y^2$$ over the prime field $\mathbb F_p$ where $p = 2^{255} - 19$. The coefficient $d = -121665/121666$ was chosen to so that this curve is birationally equivalent to the Montgomery curve $y^2 = x^3 + 486662 x^2 + x$, called Curve25519, whose coefficient 486662 was chosen to be the smallest integer in absolute value satisfying the security criteria[1]. The group of $\mathbb F_p$-rational points has composite order $8 p_1$ for a 253-bit prime $p_1$, and its twist has composite order $4 p_2$ for a 253-bit prime $p_2$. Edwards25519 is designed to make the cost of a discrete log computation cost at least about $2^{128}$ bit operations to break the first of any number of targets.

Edwards448, also known as Ed448-Goldilocks, is the untwisted Edwards curve $$x^2 + y^2 = 1 - 39081 x^2 y^2$$ over the prime field $\mathbb F_p$ where $p = 2^{448} - 2^{224} - 1$. The coefficient $d = -39081$ was chosen to be the smallest integer in absolute value satisfying the same security criteria as edwards25519, together with the additional constraint that the order of the group of $\mathbb F_p$-rational points have order below $p$, namely $4 p_1$ for a 446-bit prime $p_1$. There is also a birationally equivalent Montgomery curve $y^2 = x^3 + 156326 x^2 + x$ derived from edwards448, called Curve448. Edwards448 is designed to make the cost of a discrete log computation cost about $2^{224}$ bit operations to break the first of any number of targets. Of course, since $2^{128}$ bit operations is already infeasible, edwards448 is really a hedge against modest cryptanalytic advances.

Ed25519 is specifically an instance of the EdDSA signature scheme[2][3] with edwards25519 as the curve, SHA-512 as the hash function, an optional context identifier for compatibility, etc.; likewise Ed448 is an instance of EdDSA with edwards448 as the curve, SHAKE256 as the hash function, an obligatory domain identifier, etc. See RFC 8032 for the details of EdDSA instantiation, and RFC 7748 for the curve definitions.

The only major substantive differences are in security level and performance:

• Security level: Edwards25519 aims for a ‘128-bit security level’, and edwards448 aims for a ‘224-bit “Spinal Tap-grade” security level’—not actually a meaningful difference in the real world unless there is a modest cryptanalytic advance in computing elliptic curve discrete logs.
• Key size: Edwards448 points and scalars are 1.75x the size of edwards25519 points and scalars.
• Fixed-base scalar multiplication: Edwards448 costs about 1.5x what edwards25519 costs.
• Variable-base scalar multiplication: Edwards448 costs about 5x what edwards25519 costs.
  • (See SUPERCOP dh and sign for details.)

Edwards25519 has $p \equiv 1 \pmod 4$ while edwards448 has $p \equiv 3 \pmod 4$, so there are some differences in protocols beyond DH and signing, but not really substantive: for encoding points indistinguishably from uniform random strings, edwards25519 supports only Elligator 2, while edwards448 supports Elligator 1 and Elligator 2[4], but I don't know of any advantages to Elligator 1; both support a prime-order group encoding that avoids pitfalls with cofactors[5], with a couple of different software implementations, Ristretto for Edwards25519 and libdecaf for Edwards448. Both curves are designed for traditional discrete log applications and pass the SafeCurves criteria; neither curve is pairing-friendly.

In brief, the two curves were designed with essentially the same qualitative security criteria and differ only on quantitative security level and performance.

Answer 2

• The Ed25519 prime has $p \equiv 1 \pmod 4$, while Ed448 has $p \equiv 3 \pmod 4$. This influences the square root algorithm.
• The $a$ elliptic curve parameter is $-1$ in Ed25519, and $1$ in Ed448. This influences the elliptic curve formulas.
• Ed25519 uses SHA-512 as the internal hash function, while Ed448 uses SHAKE256 from the SHA-3 family (the same applies for the prehashed version, if used). The input to the internal hash function is handled differently in Ed25519: if not using the prehashed version, then it's the message itself; otherwise, the message (actually the hash) is prefixed with a domain separation string. In Ed448 the prefix is always there.
• The Ed25519 cofactor is $8$, while the Ed448 is cofactor is $4$. This influences the scalar "clamping" mechanism that makes sure that the order of public keys is a multiple of the cofactor.