# Converting EdDSA Keys to EC-KCDSA keys

I'm trying to create BIP32 like key derivation for EKCDSA by riding over a BIP32-EdDSA derivation

Can anyone tell me if there is a glaring problem with my conversion technique?

PrivateECKCDSA = First32Bytes(Hash512(PrivateEdDSA))
PublicECKCDSA = Convert_ED25519_to_Curve25519_public_key(PublicKeyEdDSA)

Can any buffer be considered an ECKCDSA private key? I know that because we are using curves and fields there might be some limitation (I'm really clueless about this).

Also can every EdDSA public key be converted into curve25519, or are some excluded?

If no named this conversion I'd like to call it the Yaffe Bender key conversion.

• Uh, you can do Convert_ED25519_to_Curve25519_public_key without the PrivateECKCDSA, while the private key is derived using a hash? Is that a cryptographic hash? Apr 10, 2019 at 23:06

Can anyone tell me if there is a glaring problem with my conversion technique?

PrivateECKCDSA = First32Bytes(Hash512(PrivateEdDSA))
PublicECKCDSA = Convert_ED25519_to_Curve25519_public_key(PublicKeyEdDSA)

This conversion makes no sense.

• There is no meaningful connection between what you have called PrivateECKCDSA and PublicECKCDSA, so they in no way constitute a key pair.
• If by Curve25519 you mean X25519, the public key conversion also doesn't make sense because ECKCDSA needs a full point, not just an $$x$$ coordinate.
• Why are you even doing ECKCDSA over Curve25519? Are there any protocols that use this?
• If you have to use ECKCDSA you most likely have to use a curve standardized by KISA, which is unlikely to have any relation to the curve edwards25519.
• If you don't have to use ECKCDSA, why don't you just use Ed25519 signatures?

A note on nomenclature these days: Curve25519 means the Montgomery curve $$y^2 = x^3 + 486662 x^2 + x$$ over $$\mathbb F_{2^{255} - 19}$$, while X25519 means the Diffie–Hellman function of $$x$$-restricted scalar multiplication on Curve25519. Edwards25519 means the twisted Edwards curve $$-u^2 + v^2 = 1 - (121665/121666) u^2 v^2$$ over $$\mathbb F_{2^{255} - 19}$$, while Ed25519 means the EdDSA instance with edwards25519, SHA-512, etc.

Can any buffer be considered an ECKCDSA private key? I know that because we are using curves and fields there might be some limitation (I'm really clueless about this).

An ECKCDSA private key is a near-uniform random scalar modulo the order of the curve. For a curve with a 256-bit order, like NIST P-256, you can generally use a uniform random 32-bit string as the private key.

Also can every EdDSA public key be converted into curve25519, or are some excluded?

Can't meaningfully convert an Ed448 key to an X25519 key. But if you restrict your question to converting Ed25519 keys to X25519 keys, then the answer is essentially yes: edwards25519 and Curve25519 are birationally equivalent with a map that extends to a group isomorphism, and to almost every Curve25519 public key there are two corresponding Ed25519 public keys. However, the birational map has a handful of exceptional cases, like $$u = 0$$, $$v = -1$$, etc. So be careful!

If no named this conversion I'd like to call it the Yaffe Bender key conversion.

Who seeks eponymy, might learn humility!

• () I edited my question to make my agenda more clear, yes, the Ardor Blockchain uses EKCDSA, god knows why hhh () Today I'm signing EKCDSA transactions to 32 byte public keys, so I think your wrong, you only need 1 coordinate (*) So what would be the special cases for this conversion, mean that we can't convert? Apr 11, 2019 at 11:45
• whisky tango foxtrot why don't they just use Ed25519 Apr 11, 2019 at 21:35
• @HaimBender You can encode both coordinates of a Curve25519 or edwards25519 point in just 32 bytes: use 255 bits for the $x$ coordinate, which narrows the $y$ coordinate down to at most two options; then use the remaining bit to discriminate between them. This is the standard way to encode Ed25519 public keys. (Deciding which letter to use for which form of curve left as a difficult exercise for the reader.) Apr 11, 2019 at 21:36