Anyone aware of test vectors (preferably with intermediate values) for the XEdDSA algorithm?


1 Answer 1


Open Whisper Systems' own curve25519-java repository has a few test vectors in the code in android/jni/ed25519/tests/. From xeddsa_fast_test(), you get this test vector in particular:

  • Private key is all zeroes except byte 8, which is set to 189, and then clamped and the private key generated from there
  • The message is 200 bytes of zeroes
  • The random bytes are 64 bytes of zeroes
  • The resulting signature of this should be the byte sequence 11c7f3e6c4df9e8a5150e1db3b30f92de3a3b3aa438656545fa7390f4bcc7bb26c431d9e90643e4f0eaa0e9c557766fa69ada576d63dcaf2ac326c11d0b97702.

Incidentally, XEdDSA as specified has been found not to mitigate sufficiently well against differential power analysis. If the only reason why you're interested in XEdDSA is only mitigation of power-analysis attacks, you may want to look into the Internet Draft draft-mattsson-cfrg-det-sigs-with-noise-02 instead, which took into account the aforementioned findings.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.