Questions tagged [ed25519]

Ed25519 is an algorithm for producing digital signatures. The algorithm is based on Edwards curves introduced by Bernstein et al. (2007) and named after mathematician Harold M. Edwards.

Filter by
Sorted by
Tagged with
0 votes
0 answers
33 views

Ed25519 and sealed boxes libsodium

Accidentally used ed25519 public key to create libsoidum_sealed_box. Is there any way to decrypt the data if the private key ed25519 is known?
user112852's user avatar
1 vote
1 answer
98 views

Is it safe to derive Ed25519 and Kyber private keys from the same seed?

I am designing a Hybrid Key exchange library using x25519 and Kyber, and the scheme I have in mind is as follows: Alice sending a file/message to Bob: ...
Zola Gonano's user avatar
3 votes
1 answer
452 views

Current Digital Signature Standards as of late 2023

Is my summary understanding of current (classical) Digital signature standards essentially correct? I may be totally wrong. DSA is no longer to be used for new signature generation just for checking ...
kodlu's user avatar
  • 21.2k
0 votes
0 answers
96 views

A matching X25519 public from non-clamped Ed25519-public and Ed25519-secret

Given an Ed25519 key pair, can you think of any way to get to the same X25519 public key from the Ed25519 secret as from the non-clamped(!) Ed25519 public key? ...
user569825's user avatar
2 votes
1 answer
79 views

What would be the security consequences of replacing $H(R, A, M)$ with $H(R, M)$ in EdDSA?

The question is mainly stated in the title. We don't consider any other changes to the scheme except for the following: We replace $S = H(R,A,M) \cdot a + r$ with $S = H(R,M) \cdot a + r$. My thoughts ...
tur11ng's user avatar
  • 878
1 vote
0 answers
18 views

Curious behavior of EVP_DigestSign for DKIM

Difficulties porting code to OpenSSL 3 may raise some doubts on digest signing. Before version 3 came, digest signing was the only way to use ED25519. On version 3, RSA_sign() being deprecated, I ...
Ale's user avatar
  • 111
5 votes
1 answer
528 views

Why do Ed25519 use Twisted Edwards curve but not regular Edwards curve

I'm trying to understand benefits of using Twisted Edwards curve over regular Edwards curve. I'm aware of some properties of Twisted Edwards curve that regular Edwards curve missing like isomorphism ...
pacman's user avatar
  • 409
1 vote
0 answers
148 views

Edwards curve ed25519 puzzle

Recently a friend of mine showed me a "puzzle" he created with edwards curve ed25519 It is based on adding and multiplying points on the curve You supply four arguments to the program The '...
deneth0r9's user avatar
0 votes
0 answers
29 views

Academic papers for the pros and cons of password based system and digital signature with challenge and response system

I don't really know what should be the correct title for this and the community can correct it after reading. I was the author of PKDSA (Searchable on github). I have the idea to do it because I feel ...
Hern's user avatar
  • 125
0 votes
0 answers
54 views

Digital signature with challenge and respond with PQC

Can ECDSA signature signing and verification process replaces password hashed based login system? The title of this question won't be exactly right. This is a question that I asked long time ago. I ...
Hern's user avatar
  • 125
5 votes
1 answer
270 views

RFCs & IANA specs about Ed25519 inaccurate?

While designing a crypto system based on existing standards and specifications i find myself questioning some of the accuracy in the current RFC-8037 and IANA specs around Edwards curves, 25519 and ...
ehanoc's user avatar
  • 153
10 votes
1 answer
788 views

Why Ed25519 encodes y-coordinates rather than x-coordinates

As stated in RFC8032 and FIPS 186-5, Ed25519 signatures uses the following encoding method: A curve point (x,y), with coordinates in the range 0 <= x,y < p, is coded as follows. First, encode ...
Raoul722's user avatar
  • 2,826
1 vote
0 answers
39 views

Standard vs. specific mappings in SP800-186 for code reuse between different curve models

The final SP800-186 outlines mappings between Twisted Edwards and Montgomery curves, and between Montgomery and Weierstrass curves. These mappings are defined in Appendix B. Relationships Between ...
thera's user avatar
  • 346
3 votes
1 answer
236 views

Breaking Ed25519 Discrete Logarithm with Degenerate Curve Attack

Following this question ed25519 attacks and also this paper on degenerate curve attacks https://eprint.iacr.org/2015/1233.pdf, I tried to implement my own attack: Given a point (0, y) and a scalar (k),...
J Medeiros's user avatar
9 votes
2 answers
2k views

How many valid X25519 private keys are there?

According to the Curve25519 website: Computing secret keys. Inside your program, to generate a 32-byte Curve25519 secret key, start by generating 32 secret random bytes from a cryptographically safe ...
Ben Zelnick's user avatar
4 votes
2 answers
450 views

Deriving private keys from a signature/HSM

I have access to an HSM that can sign messages but doesn't have a way to expose the private key. The signatures are deterministic (RFC 6979). Another application only works with ed25519 signatures ...
telescope's user avatar
2 votes
1 answer
58 views

Which service provider can create (claimable) accounts for managing Ed25519 keypairs (zero-knowledge fashion) by email

The title is a mouthful, allow me to explain my situation. I have a SaaS with many users. When new users join the platform, I want to create a cryptographic keypair for them (Ed25519). But I don't ...
Ilya Nevolin's user avatar
6 votes
2 answers
448 views

"Cropping" the resulting shared secret from ECDH

I'm deriving a shared secret using ECDH with Ed25519 keys. According to the specification (page 5), the shared secret then can be any valid Curve25519 public key, i.e. any valid 32 bytes. My ...
Guiomar Raissa's user avatar
3 votes
1 answer
212 views

Details about blind signature on ed25519

Recently, I started looking up for details about implementing a blind signature on ed25519 cryptographic. I saw this article https://stan.bar/blindsig/ by Stanislaw Baranski about it. In the first ...
user10002393's user avatar
1 vote
1 answer
282 views

Why are hashing private key in Ed22519 key generation and later the modifications required?

In EdDSA with Ed25519 the algorithm of public key computing is following: h = hash (privateKey) h[0] &= 0xF8 h[31] &= 0x7F h[31] |= 0x40 publicKey = h * B ...
Кирилл Волков's user avatar
4 votes
1 answer
234 views

How are the unified addition formulae in extended twisted Edwards coordinates derived from the affine addition formulae?

I am trying to understand point addition in RFC8032 section 5.1.4, which references the paper "Twisted Edwards Curves Revisited" (https://eprint.iacr.org/2008/522.pdf) to describe the quick ...
Norris Duncan's user avatar
3 votes
1 answer
586 views

Find Ed25519 Y Coordinate from X Coordinate

Are there any available formulas to determine a $Y$ coordinate given only an $X$ for the Ed25519 curve? The closest thing I've come to find is the recover_x(y, sign)...
J Medeiros's user avatar
2 votes
1 answer
178 views

In Ed25519, why not make both batch & unbatched verification follow the cofactored verification approach rather than unbatched using cofactorless?

Ed25519 uses a composite order Elliptic Curve (with a cofactor $8$) The algorithm however in the prime order subgroup of the main group. The signing operation should be using a generator/Base Point ...
user93353's user avatar
  • 2,169
3 votes
2 answers
152 views

Ed25519 - Is there a reason to not trust the signer - i.e. can there be a dishonest signer?

Ed25519 uses a composite order Elliptic Curve but works in the prime order subgroup of the main group. The signing operation should be using a generator/Base Point from the prime order subgroup. This ...
user93353's user avatar
  • 2,169
5 votes
3 answers
670 views

When working in a subgroup of EC in EdDSA (especially Ed255190), how is it OK to use operations different from that of the main group?

Ed25519 uses a composite order Elliptic Curve but works in the prime order subgroup of the main group. As per group theory, the subgroups use the group operation. However, as per this, Ed25519 ...
user93353's user avatar
  • 2,169
0 votes
0 answers
141 views

Fast methods for adding the basepoint to an elliptic curve point?

Are there any clever (fast) methods for adding the basepoint (generator) to an arbitrary point on elliptic curve, finally ending in affine coordinates? I.e. if G is ...
pointat8's user avatar
1 vote
1 answer
450 views

Why Can't I Use an Nacl Sign Keypair for Encrypt and Decrypt Operations?

I'm aware that the difference between the NaCL sign keys vs the box keys is that the secret key that comes from the NaCL box keypair is the ...
planet-pranav's user avatar
0 votes
0 answers
62 views

Check if pubkey belongs to twisted Edwards25519

I want to check if some pubkey belongs to twisted edwards25519 (I guess this is used for ed25519 ?) The problem is that I have in theory some valid pubkeys like: ...
bladzio's user avatar
  • 103
2 votes
1 answer
2k views

Can OpenSSL sign an ED25519 certificate with ECDSA-with-SHA256?

We are trying to generate some self-signed certificates to test our cybersecurity firmware before switching to a "real" CA-signed chain of trust. The specification we are coding to mandates ...
Adam Lawrence's user avatar
0 votes
0 answers
111 views

Using ed22519 signature as entropy

I am developing an application in which all application state is entirely public. Each user of the application is equipped with their own ed22519 keypair, and the application can only ask users for ...
user102401's user avatar
4 votes
2 answers
305 views

Isomorphism of Curve25519 and Ed25519?

According to this page, Curve25519 and Ed25519 are not isomorphic, because the birational equivalence equation has singularities: What does "birational equivalence" mean in a cryptographic ...
Myria's user avatar
  • 2,513
2 votes
1 answer
273 views

What is a masked secret key in the conxt of Ed25519?

The documentation for Ed25519-dalek states the following for Secretkey: The caller is responsible for ensuring that the bytes represent a masked secret key. https://docs.rs/ed25519-dalek/0.3.2/...
Nick Decroos's user avatar
1 vote
0 answers
61 views

Differing result between doubling and addition in extended twisted Edwards coordinates [closed]

While coding for Edwards curve, I noticed that, the addition formula and the doubling formula return what seems to be different result. I took the adding and doubling formula from both RFC-8032 and ...
DannyNiu's user avatar
  • 9,001
2 votes
1 answer
329 views

Test vectors (points) for Ed25519

I am trying to verify an Ed25519 implementation, but I can't find any test vectors for the curve points. All test vectors focus directly on signature constructions (EdDSA). I tried to use https://...
SquareRootOfTwentyThree's user avatar
2 votes
1 answer
3k views

Generating and validating a signature with ED25519 expanded private key

I am building a encrypted messaging app over tor network and currently I'm struggling on using tor generated ed25519 private key to sign and verify any message. Below piece of code works with a 32 ...
Miliano's user avatar
  • 21
1 vote
0 answers
85 views

Collision-resistant single-pass EdDSA?

Is there any reason why collision resistant variants of ed25519 that use a single-pass aren't used instead? For example: $n = h(noncekey \| m)$ $h(R \| pub \| n)$ instead of $h(R \| pub \| m)$ or ...
augustus's user avatar
2 votes
1 answer
620 views

Ed25519 to X25519 transportation

Using montgomeryX = (edwardsY + 1)*inverse(1 - edwardsY) mod p it is possible to transport an Edwards curve point (Ed25519 ...
FooBar's user avatar
  • 45
2 votes
1 answer
626 views

ed25519 attacks

I try to understand invalid curve attack and small subgroup attack. The lower 3 bits of a ed25519 private key are cleared to be a multiple by 8. So an attacker is unable to gain any information using ...
FooBar's user avatar
  • 45
1 vote
0 answers
44 views

Is partial computation of an Ed25519 Diffie-Hellman shared secret possible?

Let's say we're using the Ed25519 curve, and we're computing a Diffie-Hellman shared secret EC point $S$ by scalar multiplication of scalar $a$ with EC point $B$. Is there any way of partially ...
knaccc's user avatar
  • 4,712
2 votes
0 answers
145 views

Is there a Ed25519 threshold signature protocol similar to the Gennaro-Goldfeder schema for ECDSA?

I keep searching online and asking in different cryptographic communities whether there is a similar threshold signature schema (or a close one) to what Gennaro and Goldfeder proposed for ECDSA? ...
Max's user avatar
  • 121
1 vote
0 answers
56 views

Birational transformation from Edwards curve with not square d to Edwards curve with square d

How can I transform a complete twisted Edwards curve $ax^2+y^2 = 1+dx^2y^2$ with not square $d$ and square $a$ into an isomorphic Edwards curve $X^2+Y^2 = 1+DX^2Y^2$ with a square $-D$ i.e. $D = -r^2$?...
pintor's user avatar
  • 548
1 vote
0 answers
185 views

Should Ed25519 verification multiply by the cofactor?

The standardization document for Ed25519, RFC 8032, says the following method should be used for verifying Ed25519 signatures: Check the group equation $[8][S]B = [8]R + [8][k]A'$. It's sufficient, ...
Myria's user avatar
  • 2,513
0 votes
0 answers
140 views

Why is the cofactor of the twisted Edwards curve equal to 8?

While The cofactor of the Edwards curve is chosen $4$ in standards, the cofactor of the twisted Edwards curve is chosen $8$. I can't understand the reason for this. Can we choose cofactor $4$ for the ...
Mahdi Mahdavi's user avatar
3 votes
1 answer
700 views

Digital Signatures with Curve25519 key-pair

I have a public/private key pair of Curve25519 keys used by Wireguard. How can I use this keypair to generate/verify digital signatures? Preferrably, I would like to use EdDSA/Ed25519 but I struggle ...
Steffen Vogel's user avatar
1 vote
0 answers
88 views

ed25519 base point coordinates

For the ed25519 standard Base Point is $B = (x, 4/5)$. According to Stack Question the y coordinate equals ...
Кирилл Волков's user avatar
1 vote
2 answers
161 views

Why is implementation relevant to timing attacks?

Discussions from highly respected sources (details below) emphasize the importance of the implementation of cryptographic software to the effective security provided, with one particular case being ...
Joshua Honig's user avatar
8 votes
2 answers
985 views

Why Elliptic Curve Cryptography protocols depend on fixed curves?

I'm learning about Ed25519. It depends on a bunch of magic values: The finite field of order $2^{255}-19$, the specific elliptic curve over that field, a specific ...
Jasiu's user avatar
  • 181
0 votes
1 answer
281 views

How to securly save ED25519 private key on hard drive

I am developing an application which stores user's private Identity key (ed 25519) on user's hard drive without any security. What are the best practices / standards to save private key on hard drive, ...
Eirtaza's user avatar
2 votes
0 answers
123 views

Is it possible to apply the El Gamal encryption/decryption technique using Edwards curve in Montgomery form

I've been trying to understand the ElGamal encryption/decryption technique. I plan to use it for sending a private message to the server. That is: Alice needs to send $Pm$ (private message encoded via ...
Bosco Rohan Jacinto's user avatar
1 vote
0 answers
93 views

Why does EDDSA secret scaler pruning not prevent values >= prime L or zero?

I have been exploring and studying the EDDSA algorithm for curve 25519 and curve 448 in RFC 8032 (https://www.rfc-editor.org/rfc/rfc8032) as well as for curves 414 and 521 from this (https://eprint....
cookiecipher's user avatar