Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
In the final step of verifying an EdDSA signature, 4[S]B is compared to [4]R + [4][k]A.
Because I'm using the XYTZ - extended twisted Edwards coordinates, I want to, for efficiency reasons, do:
$$ Y(\text{Left}) \cdot Z(\text{Right}) = Y(\text{Right}) \cdot Z(\text{Left})$$,
But that leaves the X coordinates unchecked.
Can this check be secure?
Well, the checking procedure itself is not SUF-CMA as one can generate a second valid signature by replacing $R$ with $R+I$ where $I$ is a point of order divisible by 4.
By not checking the $X$ coordinate, you increase the number of secondary forgeries because $S$ can be replaced by $\ell-S$ or $R$ can be replaced with $R+I$ or both.
However, since the SUF-CMA security is already absent, the additional security loss is minimal. Only in cases where SUF-CMA is important and implementers decide to block it by not allowing signatures with duplicate $S$ values or by disallowing points $R$ that are not of order $\ell$ would your checking procedure introduce new attacks.
