2
$\begingroup$

It is my understanding that EdDSA uses a slight variant of Curve25519 (typically used for ECDH), called Ed25519.

Given the same private key, are the differences between the two algorithms enough to make the resulting public keys different between X25519 and Ed25519?

In other words, if I'm writing code to generate private/public key pairs, do I need separate implementations for EdDSA/Ed25519 and ECDH/X25519?

Clarification: I realize that EdDSA mandates a SHA-512 step which ECDH/X25519 does not specify. I'm curious if the public keys are the same for the given input to the scalar multiplication step.

$\endgroup$
  • $\begingroup$ You can somewhat easily translate between the curves so that you just need some light adapter code for on of the two curves. $\endgroup$ – SEJPM Dec 2 '19 at 21:25
  • $\begingroup$ Not looking for translations between the two, I'm just curious if public key calculation yields different results for the same input. (Skipping the mandated SHA-512 step for EdDSA) $\endgroup$ – darco Dec 2 '19 at 21:46
5
$\begingroup$

The public key representations are related but not the same. They cannot be used interchangeably without additional processing.

The curves are birationally equivalent; a point on a curve has an equivalent on the other curve.

So, given an EdDSA public and/or private key, you can compute an X25519 equivalent. Libraries such as libsodium provide functions to perform these computations.

Of course, it also works the other way round, even though this is slightly more convoluted due to the fact that the sign is not present in encoded X25519 keys.

There are alternatives. One of them is to use the same curve for both operations. There is nothing wrong with using Ed25519 for DH.

If what you need is store a single secret, you can simply use it for both operations. You will get 2 public keys, but given how small they are, it is rarely an issue.

Speaking of which, is storing a combined 64 byte key instead of a 32 byte key really an issue? For most applications, it rarely is.

$\endgroup$
  • $\begingroup$ Thanks! You may want to move the line "You will get 2 public keys, but given how small they are, it is rarely an issue." to the top to make the immediate answer more clear for anyone else. $\endgroup$ – darco Dec 2 '19 at 21:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.