16
$\begingroup$

I am reading https://en.wikipedia.org/wiki/Curve25519 and it states

Also in 2018, RFC 8446 was published as the new Transport Layer Security v1.3 standard. It requires mandatory support for X25519, Ed25519, X448, and Ed448 algorithms.[24]

I understand from various answers on this site that the ECDSA is a different algorithm than EdDSA with EdDSA being simpler, faster and more secure than ECDSA. I am not familiar with the math behind ECC. I am looking for answers to the following questions.

  • Is X25519 and Ed25519 the same curve?
  • Is X25519 used by ECDSA?
  • What does the X in X25519 and X448 stand for?
  • Is the security advantage of EdDSA a result or the Ed25519 curve or the different algorithm it uses than ECDSA?
  • If ECDSA is used with the 25519 curve is it just as secure as EdDSA?
  • Is ECDSA considered to be secure as of Oct 2020?
  • Should EdDSA be always used over ECDSA?
Improve this question
$\endgroup$
7
  • 2
    $\begingroup$ Voted for the close. 1 Too many eggs in the basket. 2, some of the questions have the answer here. No effort of searching, too. $\endgroup$
    – kelalaka
    Oct 8, 2020 at 13:17
  • 2
    $\begingroup$ Curve25519 over Ed25519 for key exchange? Why? $\endgroup$
    – kelalaka
    Oct 8, 2020 at 13:18
  • 6
    $\begingroup$ @kelalaka I have spent hours searching on this site. I have read tons of questions, been researching this topic to the best of my abilities. Accusing me of not spending time researching is incorrect. Not everyone on this site has a Masters Degree in Math and Computer Science. Making crypto accessible to developers like myself who are not mathematicians will increase usage of crypto and make the internet safer. Try reading Java docs on ECC as a developer it's confusing because it assumes you know the basics. Making crypto more accessible is a good thing. is this site only for experts by experts $\endgroup$
    – ams
    Oct 8, 2020 at 13:38
  • $\begingroup$ We can only act on what is written. Sorry about that. A good question may indicate what you've found by links and why they are not enough for you. The Squeamish Ossifrage answers may of the questions like (Historical note: Originally, X25519 was called Curve25519, but now Curve25519 just means the elliptic curve and X25519 means the cryptosystem.) Not necessarily 6 or 7 but at least 2 or 3. Another Why Curve25519 for encryption but Ed25519 for signatures? $\endgroup$
    – kelalaka
    Oct 8, 2020 at 13:46
  • 1
    $\begingroup$ I'm not really hostile against you or anybody, actually trying to improve your question(s). So that you can get a better response. Your first three bullets have answers on the links. So what kind of answer do you want, like yes and no? $\endgroup$
    – kelalaka
    Oct 8, 2020 at 13:55

2 Answers 2

Reset to default
21
$\begingroup$

Is X25519 and Ed25519 the same curve?

No. X25519 isn't a curve, it's an Elliptic-Curve Diffie-Hellman (ECDH) protocol using the x coordinate of the curve Curve25519. Ed25519 is an Edwards Digital Signature Algorithm using a curve which is birationally equivalent to Curve25519.

Is X25519 used by ECDSA?

No. It's not a curve, it's an ECDH protocol.

What does the X in X25519 and X448 stand for?

The X coordinate is what's transferred, the Y coordinate doesn't need to be transmitted due to the way these protocols work.

Is the security advantage of EdDSA a result or the Ed25519 curve or the different algorithm it uses than ECDSA?

Both (and somewhat neither). EdDSA's algorithm allows it to use curves that are more secure while being fast (ECDSA could be done using the complete point addition formulas over ANY elliptic curve, but it would be slower for many curves).

Additionally EdDSA is deterministic: there's no need to generate a nonce, and no need to track that a nonce is only used once. On the other hand, signing a message twice with the same key will reveal that the same message was signed.

If ECDSA is used with the 25519 curve is it just as secure as EdDSA?

Maybe. It would depend on how the math is done, and on how the nonce generation is handled.

Is ECDSA considered to be secure as of Oct 2020?

This depends on the particular implementation. It's NIST approved, and can be used securely if implemented well.

Should EdDSA be always used over ECDSA?

Not at this time. Some things will require ECDSA, for example the US government's FIPS 140 compliance doesn't allow EdDSA (yet). Also EdDSA signatures are deterministic (as mentioned above) which might pose problems to some schemes (though it does eliminate the security issues of nonce reuse that ECDSA has).

As kelalaka pointed out there already exist answers to most of these questions here, I've not bothered to link them.

Improve this answer
$\endgroup$
0
$\begingroup$

For the exact security guarantees of the Ed25519 signature scheme variants, this paper might be helpful:

The Provable Security of Ed25519: Theory and Practice

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.