Linked Questions

14 votes
1 answer
6k views

Curve25519 over Ed25519 for key exchange? Why?

I've been reading up on the Signal Protocol (in this PDF) and it seems to be using Curve25519 for ECDH and EdDSA (with Ed25519) for signatures. My question is why not use only Ed25519? This ...
OughtToPrevail's user avatar
19 votes
2 answers
12k views

Difference between X25519 vs. Ed25519

I am reading https://en.wikipedia.org/wiki/Curve25519 and it states Also in 2018, RFC 8446 was published as the new Transport Layer Security v1.3 standard. It requires mandatory support for X25519, ...
ams's user avatar
  • 631
6 votes
1 answer
4k views

What EC curve is used by Apple iOS platform?

I can't find information about EC curve used by Apple's iOS platform. The algorithm name that I could see in their docs is: ...
Oleg Gryb's user avatar
  • 366
6 votes
1 answer
621 views

Why do Ed25519 use Twisted Edwards curve but not regular Edwards curve

I'm trying to understand benefits of using Twisted Edwards curve over regular Edwards curve. I'm aware of some properties of Twisted Edwards curve that regular Edwards curve missing like isomorphism ...
pacman's user avatar
  • 429
0 votes
2 answers
823 views

The Generator point and Mod P in ECDSA

I've been reading about The discrete logarithm problem as of recent and i decided to try it out on a small portion of numbers myself and i actually came to a mental gridlock after watching this Video....
Dave Kent 's user avatar
2 votes
1 answer
809 views

Ed25519 to X25519 transportation

Using montgomeryX = (edwardsY + 1)*inverse(1 - edwardsY) mod p it is possible to transport an Edwards curve point (Ed25519 ...
FooBar's user avatar
  • 45
2 votes
1 answer
677 views

ed25519 attacks

I try to understand invalid curve attack and small subgroup attack. The lower 3 bits of a ed25519 private key are cleared to be a multiple by 8. So an attacker is unable to gain any information using ...
FooBar's user avatar
  • 45
2 votes
2 answers
310 views

How to recover y-coordinates when using XZ montgomery curve

I am using Montgomery ladder with Montgomery curve $by^2=x^3+ax^2+x$ using XZ coordinates and I recovered the $X$ value using $X3=X1/Z1$, but I don't know how to recover the $Y$ coordinates. for ...
Cisco Saeed's user avatar
0 votes
0 answers
92 views

What curves can be used with what algorithms?

I've been trying to improve my understanding of elliptic-curve cryptography; I'm currently trying to understand the extent to which curves are interchangeable. Examples of curves: P-256, Curve25519 ...
Billy's user avatar
  • 101
1 vote
0 answers
45 views

Is partial computation of an Ed25519 Diffie-Hellman shared secret possible?

Let's say we're using the Ed25519 curve, and we're computing a Diffie-Hellman shared secret EC point $S$ by scalar multiplication of scalar $a$ with EC point $B$. Is there any way of partially ...
knaccc's user avatar
  • 4,732