1
$\begingroup$

In a system I'm working with, we're using Schnorr signatures with scalars generated with libsodium's crypto_core_ed25519_scalar_random.

My goal is to use the crypto_box_easy / crypto_box_open_easy routines where Alice and Bob each have their own Scalars / Points already previously generated with crypto_core_ed25519_scalar_random and crypto_scalarmult_ed25519_base_noclamp, respectively.

I did not want to use crypto_box_keypair because I want to re-use the existing keys which Alice and Bob already have.

I've tried to use the crypto_sign_ed25519_sk_to_curve25519 / crypto_sign_ed25519_pk_to_curve25519 routines to convert the Ed25519 scalar/points to x25519. However decryption fails, so this does not seem to be the correct approach.

This routine only seems to work when the keypairs were generated with crypto_sign_ed25519_keypair, and not crypto_core_ed25519_scalar_random and crypto_scalarmult_ed25519_base_noclamp.

So the question is, what is the right way to derive a key-pair for encryption if I only have a key-pair for signing which was generated with crypto_core_ed25519_scalar_random and crypto_scalarmult_ed25519_base_noclamp?

Improve this question
$\endgroup$
7
  • $\begingroup$ Coding questions are off topic. If you are asking how to convert from ed25519 scalar into x25519 then that's on topic. All the other parts including the code are considered off topic here and should be removed from the question. They would be on topic on Stack Overflow, and you may of course advertise it below this stripped question using a comment or on the side channel chat. $\endgroup$
    – Maarten Bodewes ♦
    Jan 28, 2021 at 8:57
  • $\begingroup$ Actually a deeper question for me is what is the difference between an ed25519 scalar and ed25519 secret key. If I could get from the scalar to the secret key, then all of my problems would be solved. $\endgroup$
    – Andrej Mitrović
    Jan 28, 2021 at 9:53
  • $\begingroup$ A scalar is more of a mathematical notion, it's largely synonymous with "vector" in this case. The private key is therefore a scalar when it is used for point multiplication, but a scalar is not necessarily a private key. But yeah, maybe somebody with more of a math background would be able to explain this all in detail. $\endgroup$
    – Maarten Bodewes ♦
    Jan 28, 2021 at 10:22
  • $\begingroup$ You might get a lot of insight from this Q/A (I'd start with the answers before you get wrongfooted by the question first...) $\endgroup$
    – Maarten Bodewes ♦
    Jan 28, 2021 at 10:27
  • $\begingroup$ Thanks for the pointers. I think it's probably best if I ask my question in the libsodium repo. Apologies if my original question is off-topic. Please feel free to close. $\endgroup$
    – Andrej Mitrović
    Jan 28, 2021 at 13:55

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.