# Is the EdDSA signature scheme provable security?

The EdDSA signature scheme is a deterministic scheme. So could it be proven provable security in Random oracle model?

• @kelaka The above link is not an answer. EdDSA is essentially Schnorr and not DSA/ECDSA. – Yehuda Lindell Feb 26 at 10:16
• @YehudaLindell uh that is hard to write a nickname. ups EdDSA, I should be more careful. – kelalaka Feb 26 at 21:06
• Note that the difference between deterministic secret generation for EdDSA and regular Schnorr relates to the first step of choosing the random $k$ or $r$ (however you like to denote it). This does not use a random oracle, but rather I would look at it as a PRF based on a hash function. The replacement of the verifier message in the sigma protocol is what uses the random oracle, and this is the same for both. Another way to look at it is to say that if it is a secure signature scheme when choosing the value randomly, then it remains secure when using a PRF. – Yehuda Lindell Feb 28 at 6:05