In the final step of verifying an EdDSA signature, 4[S]B is compared to [4]R + [4][k]A.

Because I'm using the XYTZ - extended twisted Edwards coordinates, I want to, for efficiency reasons, do:

$$ Y(\text{Left}) \cdot Z(\text{Right}) = Y(\text{Right}) \cdot Z(\text{Left})$$,

But that leaves the X coordinates unchecked.

Can this check be secure?

  • $\begingroup$ For each $Y$ coordinate there can be two $X$ coordinates. Can you see that? $\endgroup$
    – kelalaka
    May 6, 2022 at 18:00
  • $\begingroup$ From the way RFC-8032 describes the encoding and decoding of points, I can see that. I used the words "half-smart" because I'm not sure if the choice of X is significant in signature verification. $\endgroup$
    – DannyNiu
    May 7, 2022 at 1:27

1 Answer 1


Well, the checking procedure itself is not SUF-CMA as one can generate a second valid signature by replacing $R$ with $R+I$ where $I$ is a point of order divisible by 4.

By not checking the $X$ coordinate, you increase the number of secondary forgeries because $S$ can be replaced by $\ell-S$ or $R$ can be replaced with $R+I$ or both.

However, since the SUF-CMA security is already absent, the additional security loss is minimal. Only in cases where SUF-CMA is important and implementers decide to block it by not allowing signatures with duplicate $S$ values or by disallowing points $R$ that are not of order $\ell$ would your checking procedure introduce new attacks.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.