3
$\begingroup$

I just found this draft/informal IETF specification: Alternative Elliptic Curve Representation:

This document specifies how to represent Montgomery curves and (twisted) Edwards curves as curves in short-Weierstrass form and illustrates how this can be used to implement elliptic curve computations using existing implementations that already implement, e.g., ECDSA and ECDH using NIST prime curves.

This triggered my curiosity as I thought that ECDSA and EdDSA had many more differences than just different curves.

From what I understand, Edwards curves can be expressed in the Weierstrass form.

How is EdDSA different from using ECDSA with an Edwards curve (e.g., Curve25519) converted to a Weierstrass curve? I am mostly interested in functional aspects rather than possible optimization(s) due to curve parameters.

Related questions: #1, #2

Improve this question
$\endgroup$
1
  • 2
    $\begingroup$ Compare EdDSA and ECDSA signature schemes! $\endgroup$
    – kelalaka
    Nov 26, 2020 at 0:28

1 Answer 1

Reset to default
7
$\begingroup$

EdDSA is not ECDSA over a different curve. Rather, it is a type of Schnorr signature. Indeed the name is very confusing, and I'm pretty sure that it was chosen in order to give this impression, since Schnorr is less well known.

Schnorr is essentially a zero-knowledge proof of knowledge of the discrete log of the public key, obtained via the Fiat-Shamir paradigm applied to the classic Schnorr Sigma protocol.

ECDSA is a completely different signature scheme, which was designed specifically to bypass Schnorr's patent (at least, this is the understanding in the field).

Improve this answer
$\endgroup$
3
  • $\begingroup$ Thanks, I was confused about the ECDSA-SHA256-25519 proposed in the document. Can you see any justification of using Curve25519 with ECDSA? $\endgroup$
    – DurandA
    Nov 26, 2020 at 12:56
  • 2
    $\begingroup$ The curve is a completely orthogonal issue to the signing scheme. If it's faster to compute ECDSA over Curve25519 and you specifically want ECDSA, then why not? However, Schnorr is better theoretically and it's faster. So, if you don't need legacy ECDSA, I don't see why you would want to do this. $\endgroup$
    – Yehuda Lindell
    Nov 26, 2020 at 13:11
  • $\begingroup$ How is Schnorr, a digital signature scheme, a zero-knowledge proof? By that standard wouldn't RSA be one, too? $\endgroup$
    – Melab
    Aug 5 at 1:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.