1
$\begingroup$

In the X3DH specification of the Signal Protocol it mentions having a signed pre-key in the key bundle. This pre-key is signed using the identity private-key.

Because the identity private-key is in the X25519 Montgomery form, it cannot be used as a signing key. Therefore signal implements XEdDSA to overcome this and converts the Montgomery form key into it's bi-rationally equivalent Edwards curve form, effectively allowing the same key to be used for key exchange and signing.

This is my limited understanding of what's taking place.

However, I'm wondering, is it possible to skip XEdDSA and still securely implement the Signal protocol (albeit modified) by having separate ed25519 keys (Edwards form) only for signing (using EdDSA).

In this situation:

  • Would the separate (ed25519) public key be sent as an additional (long term) key in the bundle (same as the identitykey).
  • Would we only need to continue signing the signed-pre key (using this ed25519 key), or will this introduce the need to also sign additional keys (since our additional signing key no longer matches with the original identitykey, possibly presenting a verification problem).

Reference: https://signal.org/docs/

$\endgroup$
1
$\begingroup$

It turns out this is possible and has been implemented in the libolm library of Matrix.

The solution adopted in this library is to generate a signing key for each user. This is an Ed25519 keypair, which is used to calculate a signature on an object including both the public Ed25519 signing key and the public Curve25519 identity key. It is then the public Ed25519 signing key which is used as the device fingerprint which Alice and Bob verify with each other. By verifying the signatures on the key object, Alice and Bob then get the same level of assurance about the ownership of the Curve25519 identity keys as if they had compared those directly.

Reference: https://gitlab.matrix.org/matrix-org/olm/blob/master/docs/signing.md

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.