3
$\begingroup$

I have a public/private key pair of Curve25519 keys used by Wireguard.

How can I use this keypair to generate/verify digital signatures?

Preferrably, I would like to use EdDSA/Ed25519 but I struggle to derive a Ed25519 keypair from the Curve25519 keys used by Wireguard.

$\endgroup$
3
  • 1
    $\begingroup$ You should be able to simply perform the public key derivation using the given private key value for EdDSA. The private key is just a single vector after all, and multiplying it with the base point of the right curve should give you the public key. I don't think that there are any differences w.r.t. the private key (it's not just a random in a range, there are some tricks in there) between Curve25519 and Ed25519, but anybody please correct me if I got that wrong. $\endgroup$
    – Maarten Bodewes
    Jul 27, 2021 at 13:22
  • $\begingroup$ Thanks for the suggestion. Unfortunately that would not allow me to use previously exchanged Curve25519 public-keys. $\endgroup$ Aug 3, 2021 at 16:23
  • 1
    $\begingroup$ I've offered a bounty. Please note that negative answers should also be accepted when conclusive (enough). $\endgroup$
    – Maarten Bodewes
    Aug 3, 2021 at 16:40

1 Answer 1

1
+100
$\begingroup$

I don't think it's possible to do what you are asking because of the way keys are generated for use in ECDH versus Ed25519.

Consider a Wireguard key pair (sk1, pk1). Note that sk1 is just 32 random bytes with the appropriate bits set/cleared (source) and that pk1 is derived from sk1 in the typical ECDH manner (source).

For Ed25519 signatures, you need to hash the 32 random bytes to produce 64 bytes, half of which are used to derive the public key the other half of which are used when creating signatures.

So you could derive a private key sk2 from sk1 and use sk2 to create Ed25519 signatures. But based on the discussion in the comments, it sounds like you want to verify these signatures without access to sk1 (presumably at the other end of the Wireguard tunnel, which only has pk1). And since you can't derive sk1 from pk1, you can't calculate SHA512(sk1) from pk1. Therefore you can't derive pk2 from pk1 alone.

$\endgroup$
4
  • $\begingroup$ Thanks Eric D!. That answers my question :) Do you know of any DSA which could use my existing key material? $\endgroup$ Aug 9, 2021 at 16:45
  • $\begingroup$ Unfortunately, I don't know of any way to safely use your existing keys for digital signatures given those constraints, but I'm fairly new to this stuff, so there might be techniques I'm unaware of. $\endgroup$
    – Eric D
    Aug 10, 2021 at 1:13
  • 1
    $\begingroup$ @SteffenVogel, I just came across this and haven't fully digested it, but I thought it might be of interest to you. If I understand the article correctly, Signal is using X25519/Curve25519 keys for signatures in its "XEdDSA" signature scheme: signal.org/docs/specifications/xeddsa $\endgroup$
    – Eric D
    Aug 16, 2021 at 0:12
  • $\begingroup$ Thanks, XEdDSA seems to be what I am looking for :) $\endgroup$ Aug 23, 2021 at 9:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.