Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ed25519]

Ed25519 is an algorithm for producing digital signatures. The algorithm is based on Edwards curves introduced by Bernstein et al. (2007) and named after mathematician Harold M. Edwards.

1
vote
1answer
44 views

Can you derive ed25519 keys from secp256k1?

Alice has a secp256k1 key pair that she used some time ago when she communicated with Bob. Bob can no longer user secp256k1 but he only uses ed25519 instead. Is there a secure algorithm that Bob can ...
1
vote
1answer
71 views

Converting EdDSA Keys to EC-KCDSA keys

I'm trying to create BIP32 like key derivation for EKCDSA by riding over a BIP32-EdDSA derivation Can anyone tell me if there is a glaring problem with my conversion technique? ...
3
votes
1answer
150 views

Curve25519 over Ed25519 for key exchange? Why?

I've been reading up on the Signal Protocol (in this PDF) and it seems to be using Curve25519 for ECDH and EdDSA (with Ed25519) for signatures. My question is why not use only Ed25519? This ...
4
votes
2answers
194 views

Elliptic curve ed25519 vs ed448 - Differences

Other than key size, What are some differences between the Elliptic curve ed25519 and ed448?
6
votes
2answers
662 views

Is it possible to derive a public key from another public key without knowing a private key (Ed25519)?

I have a following use case: User has his master public (sk) - private (pk) key pair (Ed25519). In DB we store a public key. Is ...
11
votes
1answer
171 views

How does the process of creating a new secure Elliptic Curve look like?

I'm especially curious about the technique djb would have used to come up with his Curve 25519. Say I have already written down my goals, such as - Twist Secure, Speed, Side Channel resistance, etc. ...
0
votes
1answer
56 views

ED25519 Child Key Derivation

Let's say I generate a keypair for a user with go's ed25519 package: pub, private := ed25519.GenerateKey(nil) And I want to generate additional child keys as ...
0
votes
0answers
92 views

ed25519 quantum resistant? [duplicate]

Is ed25519 quantum resistant? I am using ed25519 as a cryptographic primitive for decentralized identity platform, thus this very crucial question.
6
votes
2answers
410 views

Curve 25519 (X25519, Ed25519) Convert coordinates between Montgomery curve and twisted Edwards curve

I have some misunderstanding about EdDSA conversion coordinates between Montgomery curve and twisted Edwards curve. In https://tools.ietf.org/html/rfc7748 I see that a base point for Curve25519 is ...
0
votes
1answer
144 views

Verifying EdDSA signatures using xedDSA verify function.

I'm running into a problem where I generate signatures using a library like pynacl's (https://pynacl.readthedocs.io/en/stable/signing/) ed25519 implementation and then when I verify it using xedDSA's ...
5
votes
1answer
244 views

Ed25519 cryptanalysis and backdoor?

I am looking to implementing Ed25519 for decentralized identity at scale therefore am wondering if Ed25519 has gone through rigorous cryptanalysis and if there are any possible backdoor in the ...
2
votes
0answers
185 views

Ed25519 key generation

the following rfc describes the key-pair generation mechanism for Ed25519; the first two steps are as follows: Hash the 32-byte private key using SHA-512, storing the digest in a 64-octet ...
2
votes
0answers
120 views

Ed25519 threshold signature verification without knowing the single personal public keys

I read about ways to create a t-of-n threshold signature, corresponding to a collective public key of n players. (https://tools.ietf.org/html/draft-ford-cfrg-cosi-00 and Does Ed25519 support ...
3
votes
1answer
545 views

Is every bytestring a valid Ed25519 private key?

In other words, is it a bad idea to simply do this? signingkey = crypto_random_bytes(); verifykey = Ed25519.verifykey_from_signingkey(signingkey); Are there weak ...
2
votes
0answers
365 views

Curve25519 / Ed25519 - Generate a private key from this term

I have 2 key pairs $(x_1, y_1)$, $(x_2, y_2)$. I also have $a = $random 256-bit array and $b = $256-bit of defined values from me. I know the values for $(x_1, y_1)$, $x_2$ and $b$. But I miss the ...
3
votes
2answers
213 views

Encoding Public Keys

We would like to encode ECDSA Public Key specifically keys generated using the ed25519 for storage . What is the best and less error prone method , for now we think about using Hex strings or Base64 ...
1
vote
1answer
446 views

How many points are there on the X25519 curves?

The order of the base point, $l$, is 2^252 + 27742317777372353535851937790883648493 However, the base point group is nested within other large groups, the largest of which is of size $8l$. There are ...
1
vote
1answer
185 views

does TLS 1.3 use ECDSA-Sig-Value encoded signatures for Ed25519 / Ed448?

Quoting The Transport Layer Security (TLS) Protocol Version 1.3: ECDSA algorithms Indicates a signature algorithm using ECDSA [ECDSA], the corresponding curve as defined in ANSI X9.62 [...
6
votes
1answer
288 views

Ed25519 PKCS8 private key example from IETF draft seems malformed

Malformed PKCS8 Key Algorithm Identifiers for Ed25519, Ed448, X25519 and X448 for use in the Internet X.509 Public Key Infrastructure § 10.3. Examples of Ed25519 Private Key states the following: <...
0
votes
1answer
204 views

decoding a Ed25519 key per RFC8032

RFC8032 Edwards-Curve Digital Signature Algorithm (EdDSA) 5.1.3 Decoding states the following: Decoding a point, given as a 32-octet string, is a little more complicated. First, interpret ...
1
vote
0answers
257 views

Is Deterministic Ed25519 Key Derivation from Master Key and String Secure?

I am wanting to make deterministic (i.e. always the same for the same inputs) Ed25519 key from a master Ed25519 key and a target string (e.g. a website name, ala SQRL). My algorithm takes a 32-byte ...
4
votes
1answer
312 views

How secure is using a hash function as Key Derivation Function?

I am developing a personal project and I have the following need: given a randomly generated seed (with enough entropy) I need to generate a number $x$ of Ed25519 key pairs. These key pairs are not ...
12
votes
1answer
5k views

ECDSA, EdDSA and ed25519 relationship / compatibility

I'm trying to understand the relationship between those three signature schemes (ECDSA, EdDSA and ed25519) and mainly, to what degree are they mutually compatible in the sense of key pair derivation, ...
2
votes
2answers
110 views

ed25519 adoption — challenges

If ed25519 is that attractive that it seems to be, can someone explain why adoption has been slow and if there are, if any, challenges with implementing ed25519. Nathan Aw
1
vote
1answer
265 views

Shor algorithm and schnorr signature in ed25519

Does the application of Shor's algorithm in any way relate/affect the schnorr signature in ed25519?
0
votes
1answer
75 views

Should Ed25519 signature verification check the order and canonicity of its inputs?

Studying different implementations of Ed25519 I see that some of them check the order and canonicity of input public key and signature and some other not. Why this difference? Are these tests relevant ...
1
vote
1answer
470 views

libsodium x25519 and Ed25519 small order check

Studying libsodium implementation of x25519 and Ed25519 I saw that it performs an small order check comparing given inputs with a hard coded blacklist of values. Is this list exhaustive or it is a ...
0
votes
1answer
106 views

Encrypt or decrypt using the private key, and decrypt using the public key?

I am currently trying to figure out if my following scheme is implementable in ECC or whether I can use existing implementation. At first I was going with libsodium but it seems that it really doesn't ...
1
vote
1answer
432 views

Does “hash than sign paradigm” apply to ECDSA cryptography?

From wikipedia https://en.wikipedia.org/wiki/Digital_signature#How_they_work and other articles I see that: "There are several reasons to sign such a hash (or message digest) instead of the whole ...
3
votes
1answer
415 views

Is it safe to use same private key in two or more EC signature algorithms?

Given two (or more) algorithms: ed25519 private key is random blob of 32 bytes public key is encoded point on Edwards 25519 curve. ECDSA with secp256k1 private key is random blob of 32 bytes ...
1
vote
1answer
91 views

Short Ed25519 keys: can I use as ID?

I am building the distributed system, where each user sends signed messages. I dont want to have a certificates system for public keys, like it is done in SSL, so I thought to use public keys ...
5
votes
2answers
803 views

Why are NaCl secret keys 64 bytes for signing, but 32 bytes for box?

Ed25519 secret and public keys can both be represented in 32 bytes. Why does NaCl use 64 byte signing keys?
0
votes
1answer
194 views

Is TweetNaCl secure enough? [closed]

I decided to use TweetNaCl in my project and did some tests. For some reason, its Ed25519 signing mechanism gives me very short public and private keys, as opposed to RSA, though RSA, as I it ...
6
votes
1answer
167 views

Why does RFC8032#8.7 state that the IUF hash API should not be used for Ed25519?

RFC8032 (section 8.7) states that IUF (Init, Update, Finish) should not be used in Ed25519 API: Avoid signing large amounts of data at once (where "large" depends on the expected verifier). In ...
3
votes
1answer
559 views

Is it possible to derive an Ed25519-public-key from an Ed25519-signature?

If you have an Ed25519-signature and the signed message, can you derive the corresponding public-key or is the signature anonymous (except if you already know the public-key of course)?
2
votes
1answer
565 views

How use multiple keys to sign the same document?

I’m thinking about create one software, that will need the user to sign each document, using Ed25519. I need to create something that is secure and simple. Requering use a HSM is not viable and ...
4
votes
1answer
545 views

EdDSA (Ed25519) is any random number sufficient for a good private key?

Looking at a reference implementation it shows that the key pair generation simply does: read X bytes from RNG and then derive another value from these X bytes thus producing private key with derived ...
3
votes
0answers
206 views

Could a C25519/ED25519 cryptographic module be FIPS certified?

NIST algorithms include ECDH and ECDSA. NIST also specifies curves. Is the use of NIST curves required for FIPS certification or could other curves theoretically be certified if someone were willing ...
0
votes
1answer
115 views

Representing Ed25519 p curve in hexadecimal byte string

I am interested in representing p = 2^255 - 19 in the Ed255519 curve as hexadecimal byte representation. When I was looking through the original NaCL source code written by DJB, I saw a code fragment ...
4
votes
2answers
376 views

Converting a C25519 curve into a NIST-supported curve for FIPS crypto

If I have a cryptosystem based on C25519 ECC crypto, is it possible to use the same public/private key pairs for key agreement in a FIPS compliant way by deterministically converting C25519 public and ...
1
vote
1answer
387 views

How do I multiply a Twisted Edwards point in Montgomery space?

EdDSA (and ed25519) signatures require a scalar multiplication. Currently, I do this directly in Twisted Edwards space. (The code can be found in my crypto library.) My research and my tests ...
26
votes
5answers
7k views

Is it bad to expose the public key?

I am studying about blockchain and have been focusing on encryption protocols that allow authentication. The digital signature of public and private key seems solid, I have focused on the algorithm ...
2
votes
1answer
188 views

How Mutual authentication and Forward secrecy in The X3DH Key Agreement Protocol work?

Can someone explain the statement below from section 3.3 in The X3DH Key Agreement Protocol? DH1 = DH(IKA, SPKB) DH2 = DH(EKA, IKB) DH3 = DH(EKA, SPKB) DH4 = DH(EKA, OPKB) SK = ...
0
votes
1answer
322 views

Deniability and Prekey Security in X3DH Key Agreement Protocol

Can someone please explain the below paragraphs from The X3DH Key Agreement Protocol? 1st paragraph: What is deniability and how does it work here? Deniability X3DH doesn't give either Alice ...
0
votes
1answer
227 views

Cryptographic notation in X3DH Key Agreement Protocol

Can someone please explain the below paragraphs from section 2.2 in The X3DH Key Agreement Protocol? Please try to explain the whole paragraphs. 1st paragraph: I want to understand how the DH ...
1
vote
1answer
126 views

Performance consideration in XEdDSA and VXEdDSA Signature Schemes

Can someone please explain the below paragraph from section 7 in The XEdDSA and VXEdDSA Signature Schemes? The below para states that we are hashing twice (I am not able to get that). How pre-hashing ...
0
votes
1answer
416 views

Hash functions in XEdDSA and VXEdDSA Signature Schemes

Can someone please explain the below paragraph from section 2.5 in The XEdDSA and VXEdDSA Signature Schemes? Specifically I want to understand how we are defining the family of hash functions and how ...
11
votes
1answer
990 views

Can I use signature(hash(message)) instead of signature(message)?

Background: We use the TweetNaCl crypto library by Bernstein (tweetnacl.cr.yp.to) et al and we would like to stick to it. However, we have the need to sign large messages and the library does not ...
4
votes
1answer
254 views

Are the first 4 bytes of a Ed25519 public key random?

We are using the Ed25519 signature scheme (which uses Curve25519). A key pair is generated by generating the secret key from random data and then computing the 32-byte (256-bit) public key from said ...
0
votes
1answer
167 views

what is the maximum size of the payload data when using ed25519

When using ed25519 what is the maximum size of the message/payload data? From the specs: The Diffie-Hellman key exchange is then defined as follows: each party generates a random number 1 <= ...