Questions tagged [ed25519]

Ed25519 is an algorithm for producing digital signatures. The algorithm is based on Edwards curves introduced by Bernstein et al. (2007) and named after mathematician Harold M. Edwards.

Filter by
Sorted by
Tagged with
2 votes
1 answer
174 views

What is a masked secret key in the conxt of Ed25519?

The documentation for Ed25519-dalek states the following for Secretkey: The caller is responsible for ensuring that the bytes represent a masked secret key. https://docs.rs/ed25519-dalek/0.3.2/...
user avatar
1 vote
0 answers
25 views

Differing result between doubling and addition in extended twisted Edwards coordinates [closed]

While coding for Edwards curve, I noticed that, the addition formula and the doubling formula return what seems to be different result. I took the adding and doubling formula from both RFC-8032 and ...
user avatar
  • 6,551
1 vote
1 answer
55 views

Test vectors (points) for Ed25519

I am trying to verify an Ed25519 implementation, but I can't find any test vectors for the curve points. All test vectors focus directly on signature constructions (EdDSA). I tried to use https://...
user avatar
2 votes
1 answer
77 views

Generating and validating a signature with ED25519 expanded private key

I am building a encrypted messaging app over tor network and currently I'm struggling on using tor generated ed25519 private key to sign and verify any message. Below piece of code works with a 32 ...
user avatar
  • 21
1 vote
0 answers
63 views

Collision-resistant single-pass EdDSA?

Is there any reason why collision resistant variants of ed25519 that use a single-pass aren't used instead? For example: $n = h(noncekey \| m)$ $h(R \| pub \| n)$ instead of $h(R \| pub \| m)$ or ...
user avatar
2 votes
1 answer
126 views

Ed25519 to X25519 transportation

Using montgomeryX = (edwardsY + 1)*inverse(1 - edwardsY) mod p it is possible to transport an Edwards curve point (Ed25519 ...
user avatar
  • 45
2 votes
1 answer
235 views

ed25519 attacks

I try to understand invalid curve attack and small subgroup attack. The lower 3 bits of a ed25519 private key are cleared to be a multiple by 8. So an attacker is unable to gain any information using ...
user avatar
  • 45
0 votes
0 answers
35 views

Consequences of leaking one byte of an ECDH shared secret

An EC point $B$ is published publicly so that a recipient in possession of a scalar $a$ can calculate the shared secret $S = [a]B$. This is done with the Ed25519 curve. If the sender (who knows $b$ ...
user avatar
  • 2,598
1 vote
0 answers
33 views

Is partial computation of an Ed25519 Diffie-Hellman shared secret possible?

Let's say we're using the Ed25519 curve, and we're computing a Diffie-Hellman shared secret EC point $S$ by scalar multiplication of scalar $a$ with EC point $B$. Is there any way of partially ...
user avatar
  • 2,598
1 vote
0 answers
52 views

Is there a Ed25519 threshold signature protocol similar to the Gennaro-Goldfeder schema for ECDSA?

I keep searching online and asking in different cryptographic communities whether there is a similar threshold signature schema (or a close one) to what Gennaro and Goldfeder proposed for ECDSA? ...
user avatar
  • 111
1 vote
0 answers
46 views

Birational transformation from Edwards curve with not square d to Edwards curve with square d

How can I transform a complete twisted Edwards curve $ax^2+y^2 = 1+dx^2y^2$ with not square $d$ and square $a$ into an isomorphic Edwards curve $X^2+Y^2 = 1+DX^2Y^2$ with a square $-D$ i.e. $D = -r^2$?...
user avatar
  • 390
1 vote
0 answers
51 views

Should Ed25519 verification multiply by the cofactor?

The standardization document for Ed25519, RFC 8032, says the following method should be used for verifying Ed25519 signatures: Check the group equation $[8][S]B = [8]R + [8][k]A'$. It's sufficient, ...
user avatar
  • 2,174
0 votes
0 answers
62 views

Why is the cofactor of the twisted Edwards curve equal to 8?

While The cofactor of the Edwards curve is chosen $4$ in standards, the cofactor of the twisted Edwards curve is chosen $8$. I can't understand the reason for this. Can we choose cofactor $4$ for the ...
user avatar
3 votes
1 answer
215 views

Digital Signatures with Curve25519 key-pair

I have a public/private key pair of Curve25519 keys used by Wireguard. How can I use this keypair to generate/verify digital signatures? Preferrably, I would like to use EdDSA/Ed25519 but I struggle ...
user avatar
1 vote
0 answers
45 views

ed25519 base point coordinates

For the ed25519 standard Base Point is $B = (x, 4/5)$. According to Stack Question the y coordinate equals ...
user avatar
1 vote
2 answers
85 views

Why is implementation relevant to timing attacks?

Discussions from highly respected sources (details below) emphasize the importance of the implementation of cryptographic software to the effective security provided, with one particular case being ...
user avatar
8 votes
2 answers
885 views

Why Elliptic Curve Cryptography protocols depend on fixed curves?

I'm learning about Ed25519. It depends on a bunch of magic values: The finite field of order $2^{255}-19$, the specific elliptic curve over that field, a specific ...
user avatar
  • 181
0 votes
1 answer
134 views

How to securly save ED25519 private key on hard drive

I am developing an application which stores user's private Identity key (ed 25519) on user's hard drive without any security. What are the best practices / standards to save private key on hard drive, ...
user avatar
1 vote
0 answers
73 views

Is it possible to apply the El Gamal encryption/decryption technique using Edwards curve in Montgomery form

I've been trying to understand the ElGamal encryption/decryption technique. I plan to use it for sending a private message to the server. That is: Alice needs to send $Pm$ (private message encoded via ...
user avatar
1 vote
0 answers
63 views

Why does EDDSA secret scaler pruning not prevent values >= prime L or zero?

I have been exploring and studying the EDDSA algorithm for curve 25519 and curve 448 in RFC 8032 (https://www.rfc-editor.org/rfc/rfc8032) as well as for curves 414 and 521 from this (https://eprint....
user avatar
1 vote
2 answers
306 views

Is it possible to unscramble a scrambled ed25519 SSH key?

Let's say I generate an ed25519 SSH key with ssh-keygen -t ed25519. Then I take the private key file and randomly scramble the order of base64 encoded characters. ...
user avatar
  • 13
0 votes
1 answer
78 views

Why computation of $u*v^3*(u*v^7)^{(p-5)/8}$ is suggested instead of $(u/v)^{(p+3)/8}$

Working with Curve25519 I've faced with suggested form of computation square root candidate as: $uv^3(uv^7)^{\frac{p-5}{8}}$ instead of $\left(\frac{u}{v}\right)^{\frac{p+3}{8}}$. Why it is so? Or why ...
user avatar
2 votes
1 answer
74 views

Ed25519 signature verification as described in RFC 8032

In RFC 8032, section 5.1.7, it is prescribed that an Ed25519 signature is verified if $[8][S]B = [8]R + [8][k]A'.$ The text then says It's sufficient, but not required, to instead check $[S]B = R + ...
user avatar
  • 71
2 votes
1 answer
307 views

Test vectors for Ed25519

My apologies if this is obvious, but the truth is that I am confused about this. I am looking into RFC 8032 for test vectors for Ed25519, and I have some doubts concerning the information presented in ...
user avatar
  • 71
1 vote
0 answers
65 views

Same Ed25519 key for signing and encryption? [duplicate]

I know this has been asked before, but it's still unclear whether this is an OK practice. The advice seems to never do this unless you have to, but I can think of some examples where this could be ...
user avatar
  • 11
1 vote
0 answers
94 views

How do I convert an ed25519 scalar into x25519 for encryption?

In a system I'm working with, we're using Schnorr signatures with scalars generated with libsodium's crypto_core_ed25519_scalar_random. My goal is to use the ...
user avatar
0 votes
1 answer
2k views

What is the public key length of RSA and Ed25519?

I have made some research but doesn't understand fully: In this link, it says ed25519 has a length of 64 characters. Questions: Is this base64 encoded characters? And does ed25519 limit to only 64 ...
user avatar
  • 103
1 vote
1 answer
389 views

Encode ASN.1 PKCS#8 Private Key with Public Key and attributes

I'm trying to encode an Ed25519 private key as a PEM file based on this document https://www.rfc-editor.org/rfc/rfc8410#page-7 . I'm using an ASN.1 encoder written in Dart, and I can encode the ...
user avatar
2 votes
1 answer
67 views

Compact ROM with space only for EdDSA. How to fit a key exchange algorithm inside?

I have implemented Ed25519 for a constrained-memory system, and I want to provide a Shared Secret functionality. The recommended method is to use X25519 for this; but then I would have to implement ...
user avatar
  • 402
12 votes
2 answers
5k views

Difference between X25519 vs. Ed25519

I am reading https://en.wikipedia.org/wiki/Curve25519 and it states Also in 2018, RFC 8446 was published as the new Transport Layer Security v1.3 standard. It requires mandatory support for X25519, ...
user avatar
  • 461
1 vote
0 answers
80 views

Difference and relation between ed25519, x25519 and XEd25519 [duplicate]

In my Rust implementation of a messaging system, I'm using currently two cryptographic primitives: ed25519_dalek and x25519_dalek. I use ed25519_dalek for DSA, while x25519_dalek for encryption of the ...
user avatar
  • 235
3 votes
1 answer
185 views

Signature Generation Time vs Verification Time

When comparing the RSA-PSS signature algorithm with an elliptic curve based algorithm such as EdDSA, it is clear that signature verification takes less time for RSA than for EdDSA. For signature ...
user avatar
  • 276
1 vote
1 answer
143 views

Point Matching Function for Curve 25519

Does anybody know a point-matching function for curve 25519? Or has a straight-forward way how to derive any arbitrary point-matching function? It should be like a reversible mapping from and to a 128+...
user avatar
  • 75
6 votes
1 answer
4k views

Why are ed25519 keys not recommended for encryption?

Was wondering why there is no straightforward way of using ed25519 keys for encryption. Then I found this: https://github.com/indutny/elliptic/issues/108 There it is stated that it's unlike RSA not ...
user avatar
  • 75
0 votes
0 answers
102 views

is it safe to do public key to public key derivation with Ed25519?

Deriving a public key from a public key in Ed25519 is possible, some algorithms are available. My question is why there are so few implementations compared to secp256k1 for example. The extra checks ...
user avatar
0 votes
1 answer
409 views

Can the EdDSA signature scheme be customized with OpenSSL?

EdDSA has currently two signature schemes: Ed25519 and Ed448. Ed25519 is the EdDSA signature scheme using SHA-512 (SHA-2) and Curve25519 Ed448 is the EdDSA signature scheme using SHAKE256 (SHA-3) ...
user avatar
  • 111
2 votes
1 answer
531 views

OID for Ed25519

I am working on a code generating Edwards curve (Ed25519) keys in a HSM using PKCS#11 API. In the public key template the CKA_EC_PARAMS uses an OID to specify the curve. The encoding for Ed25519 is ...
user avatar
  • 23
0 votes
1 answer
73 views

Looking for feedback on the cryptographic design of my open source project: Bloom [closed]

I'm about to release the new version of my open source project: Bloom (encrypted Notes, Calendar, Contacts, Files…) which will feature end-to-end encryption. I've published the cryptographic details ...
user avatar
7 votes
1 answer
610 views

When using Ristretto or Decaf with Ed25519 and Ed448, do scalars still need pruning/trimming/clamping?

Decaf is a point compression method that builds a prime-order group for (twisted) Edwards curves and Montgomery curves with cofactor $h = 4$ based on the Jacobi quartic [H2015]. The promise is to ...
user avatar
  • 619
0 votes
1 answer
143 views

Why does ed25519 seem to accept and use 96-byte / 384-bit signatures?

Why do ed25519 signature verify functions accept 96-byte signatures? Take this piece of code for one example: crypto_sign_ed25519_open() requires that signatures be ...
user avatar
0 votes
0 answers
409 views

Comparisons of ECDSA, EdDSA and BLS Signatures in Blockchain: Pros and Cons

As we know, the most used digital scheme in Blockchain is ECDSA. For now, more and more blockchain projects, I've noticed, are considering substituting EdDSA and BLS signature scheme as the new one. ...
user avatar
3 votes
1 answer
2k views

Should I use NaCl or libsodium for my application?

While looking for end-to-end encryption for my app users, I stumbled upon NaCl and libsodium. I am unsure from a security perspective which of these implementations I should use for my cross-platform ...
user avatar
1 vote
1 answer
187 views

Proof of possession. x25519 + ed25519

There are Client and Server. Client have previously send public keys for x25519 and ed25519 to the server. And now need to prove that it has private keys for them. I have found similar solutions in ...
user avatar
2 votes
1 answer
173 views

Is the EdDSA signature scheme provable security?

The EdDSA signature scheme is a deterministic scheme. So could it be proven provable security in Random oracle model?
user avatar
3 votes
1 answer
190 views

Is Ed25519 really constant-time as widely implemented?

Despite the frequent claims that Ed25519 is more secure against side-channel attacks than (for instance) signatures performed over NIST P-256, I noticed that most implementations (including the ...
user avatar
5 votes
2 answers
316 views

Why does EdDSA require a b-bit private key instead of b/2-bit?

By design, EdDSA requires a $b$-bit string as the secret key $k$, and when signing, it is expanded to a $2b$-bit string $H(k)$, some bit-twiddling is done, and the first half is used as the private ...
user avatar
0 votes
2 answers
636 views

Computing PGP ed25519 and curve25519 keygrips?

There are public key algorithmic differences for how PGP computes fingerprints and keygrips. For the v4 protocol, fingerprints are not exclusively computed from public keys while keygrips are. RFC ...
user avatar
  • 131
2 votes
0 answers
248 views

Does EdDSA share Schnorr signature secure linearity property?

EdDSA, Edwards-curve Digital Signature Algorithm (EdDSA), is a digital signature scheme using a variant of Schnorr signature based on Twisted Edwards curves (source). Schnorr signatures have a ...
user avatar
1 vote
1 answer
384 views

Key clamping in curve25519 not evident in generated key's binary representation

I understand with curve25519 that the private key for secret.box is clamped... I understand that this clamping process to clear ...
user avatar
  • 1,212
2 votes
1 answer
502 views

Why does curve25519 use a cofactor of 8?

This cofactor (as I understand it) effectively discards valid points that satisfy the curve equation over the finite field. Why would one wish to reduce the number of possible private keys, it seems ...
user avatar
  • 1,212