Good day!

I am very new to Cryptography but I want to make sure I understand the concept of the scheme correctly before using it to our system. So I was looking at post quantum signature schemes, and I came across Dilithium(https://github.com/pq-crystals/dilithium), and our system currently runs on Ed25519 which based on my question can easily take a secret key and generate a deterministic public key from it.

So my question is, can Dilithium also be useable on this type of implementation, like what Elliptic Curve stuff can do? Because based on the white paper I have read in Dilithium, I just need the random 256 bit seed, and I can create the pk and sk, but I cannot take an sk and derive a pk from it. I can however get the 256 random key and generate a key from it, but it just makes the same key as the first key generation.

Let me know if this makes sense.

Thank you.

  • $\begingroup$ Is this a question about what is technically possible, or is this a question about the efficiency of storing just a seed and regenerating the secret key and public key on demand, vs. storing the secret key and public key together? $\endgroup$ – Squeamish Ossifrage Apr 17 at 16:35
  • $\begingroup$ @Squeamish Ossifrage Its about if it is technically possible to create such implementation. Thanks for clearing this up. $\endgroup$ – josephnicholas Apr 18 at 3:26
  • $\begingroup$ So, it looks like you answered your own question—you can store the seed, and rerun the key generation process with a deterministic PRNG to get the same key pair? $\endgroup$ – Squeamish Ossifrage Apr 18 at 3:28
  • $\begingroup$ @SqueamishOssifrage, So for example, I have an external PRNG from another system, so I use that 256 bits of entropy as parameter to my function then generate the keypair from that. So we have now sk and pk, but I want to create another pk from the same sk and generate pk1, which is derived from sk. How do I do that in Dilithium? Because using same 256 bit entropy will just generate same public key. My goal is to create another one(pk) that is still linked to my sk. So I can sign with my sk, and verify with my pk or my another derived pk1. $\endgroup$ – josephnicholas Apr 18 at 3:34
  • $\begingroup$ It sounds like you are talking about hierarchical key derivation, then, not just compressed key storage? $\endgroup$ – Squeamish Ossifrage Apr 18 at 3:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.