Questions tagged [ed25519]

Ed25519 is an algorithm for producing digital signatures. The algorithm is based on Edwards curves introduced by Bernstein et al. (2007) and named after mathematician Harold M. Edwards.

Filter by
Sorted by
Tagged with
1
vote
0answers
31 views

Does EdDSA share Schnorr signature secure linearity property?

EdDSA, Edwards-curve Digital Signature Algorithm (EdDSA) is a digital signature scheme using a variant of Schnorr signature based on Twisted Edwards curves (source). Schnorr signatures have a ...
0
votes
1answer
58 views

Key clamping in curve25519 not evident in generated key's binary representation

I understand with curve25519 that the private key for secret.box is clamped... I understand that this clamping process to clear ...
0
votes
1answer
94 views

Why does curve25519 use a cofactor of 8?

This cofactor (as I understand it) effectively discards valid points that satisfy the curve equation over the finite field. Why would one wish to reduce the number of possible private keys, it seems ...
0
votes
1answer
45 views

Securely derive AES and ED25519 keys from a ED25519 seed

Go's ed25519 package exposes a function which allows creating a private key from a 32 byte seed. See: https://godoc.org/golang.org/x/crypto/ed25519#NewKeyFromSeed The reason I want to use this is ...
0
votes
0answers
33 views

Possible to convert PGP ed25519 signature into signify-compatible format?

Both PGP and Signify (or Minisign) are capable of generating ED25519 detached signatures. Is it possible to convert a PGP-generated ED25519 signature into a signify-compatible format?
0
votes
1answer
58 views

How to check runtime of e.g. Ed25519 signature algorithm

As mentioned here the verification of a Ed25519 signature takes roughly 3 times as the time for the generation of a signature. Two questions on that: 1) Can I assume that this is a rule of thumb for ...
1
vote
2answers
84 views

Using public-key signature instead of having API key

I am designing an application that will need an API key. At first I believed that generating a long, random token would be secure enough (say 32 chars string that includes 0-9, a-z and A-Z), and then ...
5
votes
2answers
1k views

Raw curve25519 public key points

I'm trying to understand curve25519, and ECC public points. I'm playing with Minisign, to better understand the fundamentals of ECC. Minisign uses curve25519 and outputs public keys as base64 ...
5
votes
1answer
375 views

Difference between Pure EdDSA (ed25519) and HashEdDSA (ed25519ph)

My question refers to EdDSA as specified in RFC 8032. I get from the RFC that ed25519 and ed25519ph are two different instances of EdDSA mainly differing in the fact that that in the case of ...
1
vote
1answer
178 views

openssh ed2215 private key format

i have generated an ed2215 private key as follows: $ ssh-keygen -o -a 100 -t ed25519 -f id_ed25519 and it looks like ...
0
votes
1answer
93 views

Onion address encoding [closed]

Could you please explain what the pipe (|) in tor specification means -- is it a bitwise or or a concatenation of the values? Encoding onion addresses [...
2
votes
1answer
67 views

Why does Ed25519 scalar multiplication allow values larger than the subgroup order?

The GeScalarMultBase function is documented like so. From the way it is documented we see that it expects a little-endian value and has a precondition that constrains the range it accepts. ...
5
votes
0answers
358 views

Signal Protocol - Better way to generate one time pre keys (OTPK)

The following explains a different way (then one time pre keys) for Bob to securely generate ephemeral keys asynchronously without a limit while still being able to delete the private key immediately ...
0
votes
1answer
65 views

Are EdDSA algorithms encoded by ASN.1 DER standards?

Is it required, or widely practiced to encode a EdDSA signature as a ASN.1 Sequence? Why or why not? How should you encode a EdDSA signature? I cannot find mention of DER or ASN in the EdDSA RFC. ...
1
vote
1answer
144 views

What is “spinal-tap grade” security?

As stated here Ed448 is different from Ed25519 because of "spinal-tap grade" security. What does this mean?
1
vote
1answer
71 views

Valid private keys on curve25519

Given that valid private keys on curve25519 must be less than the order of the curve which is (as I understand) already smaller than 2^256, AND a valid key must be clamped to be divisible by 8 and ...
0
votes
1answer
43 views

Is there a lower limit on message length for signature?

I was working on a tool that signs small messages (~20 bytes) when a question occurred about message size: What would be the risk of using extremely small/restricted input (say, 5 bytes of hexadecimal ...
2
votes
1answer
123 views

How can I avoid side channel attacks to scalar multiplication of Ed25519?

I'm a beginner of Edwards curve. And I'm trying to implement Ed25519 signature.There is python illustration at page 20. At the part of scalar multiplication it simply use double and add method: <...
0
votes
1answer
69 views

How to convert d into 64bit limbs? [closed]

Given a d value = -(10240/10241) How would I convert this into 64 bit limbs? I have to expand on this because of stackoverflow quality algorithm, I've tried using python to get the integer rep/hex ...
1
vote
1answer
63 views

Check if two ed25519 points are equivalent

How to check if two points are equivalent given their projective coordinates (XYTZ)? For example if I do unproject() of a point to pass from XYTZ to XY coordinates and then I come back to XYTZ ...
1
vote
1answer
135 views

Can you derive ed25519 keys from secp256k1?

Alice has a secp256k1 key pair that she used some time ago when she communicated with Bob. Bob can no longer user secp256k1 but he only uses ed25519 instead. Is there a secure algorithm that Bob can ...
1
vote
1answer
122 views

Converting EdDSA Keys to EC-KCDSA keys

I'm trying to create BIP32 like key derivation for EKCDSA by riding over a BIP32-EdDSA derivation Can anyone tell me if there is a glaring problem with my conversion technique? ...
4
votes
1answer
952 views

Curve25519 over Ed25519 for key exchange? Why?

I've been reading up on the Signal Protocol (in this PDF) and it seems to be using Curve25519 for ECDH and EdDSA (with Ed25519) for signatures. My question is why not use only Ed25519? This ...
6
votes
2answers
1k views

Elliptic curve ed25519 vs ed448 - Differences

Other than key size, What are some differences between the Elliptic curve ed25519 and ed448?
6
votes
2answers
743 views

Is it possible to derive a public key from another public key without knowing a private key (Ed25519)?

I have a following use case: User has his master public (sk) - private (pk) key pair (Ed25519). In DB we store a public key. Is ...
11
votes
1answer
208 views

How does the process of creating a new secure Elliptic Curve look like?

I'm especially curious about the technique djb would have used to come up with his Curve 25519. Say I have already written down my goals, such as - Twist Secure, Speed, Side Channel resistance, etc. ...
0
votes
1answer
122 views

ED25519 Child Key Derivation

Let's say I generate a keypair for a user with go's ed25519 package: pub, private := ed25519.GenerateKey(nil) And I want to generate additional child keys as ...
0
votes
0answers
344 views

ed25519 quantum resistant? [duplicate]

Is ed25519 quantum resistant? I am using ed25519 as a cryptographic primitive for decentralized identity platform, thus this very crucial question.
7
votes
2answers
612 views

Curve 25519 (X25519, Ed25519) Convert coordinates between Montgomery curve and twisted Edwards curve

I have some misunderstanding about EdDSA conversion coordinates between Montgomery curve and twisted Edwards curve. In https://tools.ietf.org/html/rfc7748 I see that a base point for Curve25519 is ...
0
votes
1answer
544 views

Verifying EdDSA signatures using xedDSA verify function.

I'm running into a problem where I generate signatures using a library like pynacl's (https://pynacl.readthedocs.io/en/stable/signing/) ed25519 implementation and then when I verify it using xedDSA's ...
4
votes
1answer
385 views

Ed25519 cryptanalysis and backdoor?

I am looking to implement Ed25519 for decentralized identity at scale. Has Ed25519 has gone through rigorous cryptanalysis? Could there be a backdoor in the algorithm?
3
votes
1answer
350 views

Ed25519 key generation

the following rfc describes the key-pair generation mechanism for Ed25519; the first two steps are as follows: Hash the 32-byte private key using SHA-512, storing the digest in a 64-octet ...
2
votes
0answers
184 views

Ed25519 threshold signature verification without knowing the single personal public keys

I read about ways to create a t-of-n threshold signature, corresponding to a collective public key of n players. (https://tools.ietf.org/html/draft-ford-cfrg-cosi-00 and Does Ed25519 support ...
4
votes
1answer
855 views

Is every bytestring a valid Ed25519 private key?

In other words, is it a bad idea to simply do this? signingkey = crypto_random_bytes(); verifykey = Ed25519.verifykey_from_signingkey(signingkey); Are there weak ...
2
votes
0answers
468 views

Curve25519 / Ed25519 - Generate a private key from this term

I have 2 key pairs $(x_1, y_1)$, $(x_2, y_2)$. I also have $a = $random 256-bit array and $b = $256-bit of defined values from me. I know the values for $(x_1, y_1)$, $x_2$ and $b$. But I miss the ...
3
votes
2answers
351 views

Encoding Public Keys

We would like to encode ECDSA Public Key specifically keys generated using the ed25519 for storage . What is the best and less error prone method , for now we think about using Hex strings or Base64 ...
1
vote
1answer
556 views

How many points are there on the X25519 curves?

The order of the base point, $l$, is 2^252 + 27742317777372353535851937790883648493 However, the base point group is nested within other large groups, the largest of which is of size $8l$. There are ...
1
vote
1answer
308 views

does TLS 1.3 use ECDSA-Sig-Value encoded signatures for Ed25519 / Ed448?

Quoting The Transport Layer Security (TLS) Protocol Version 1.3: ECDSA algorithms Indicates a signature algorithm using ECDSA [ECDSA], the corresponding curve as defined in ANSI X9.62 [...
6
votes
1answer
505 views

Ed25519 PKCS8 private key example from IETF draft seems malformed

Malformed PKCS8 Key Algorithm Identifiers for Ed25519, Ed448, X25519 and X448 for use in the Internet X.509 Public Key Infrastructure § 10.3. Examples of Ed25519 Private Key states the following: <...
0
votes
1answer
293 views

decoding a Ed25519 key per RFC8032

RFC8032 Edwards-Curve Digital Signature Algorithm (EdDSA) 5.1.3 Decoding states the following: Decoding a point, given as a 32-octet string, is a little more complicated. First, interpret ...
1
vote
0answers
348 views

Is Deterministic Ed25519 Key Derivation from Master Key and String Secure?

I am wanting to make deterministic (i.e. always the same for the same inputs) Ed25519 key from a master Ed25519 key and a target string (e.g. a website name, ala SQRL). My algorithm takes a 32-byte ...
4
votes
1answer
418 views

How secure is using a hash function as Key Derivation Function?

I am developing a personal project and I have the following need: given a randomly generated seed (with enough entropy) I need to generate a number $x$ of Ed25519 key pairs. These key pairs are not ...
23
votes
1answer
9k views

ECDSA, EdDSA and ed25519 relationship / compatibility

I'm trying to understand the relationship between those three signature schemes (ECDSA, EdDSA and ed25519) and mainly, to what degree are they mutually compatible in the sense of key pair derivation, ...
2
votes
2answers
132 views

ed25519 adoption — challenges

If ed25519 is that attractive that it seems to be, can someone explain why adoption has been slow and if there are, if any, challenges with implementing ed25519. Nathan Aw
2
votes
1answer
406 views

Shor algorithm and schnorr signature in ed25519

Does the application of Shor's algorithm in any way relate/affect the schnorr signature in ed25519?
0
votes
1answer
150 views

Should Ed25519 signature verification check the order and canonicity of its inputs?

Studying different implementations of Ed25519 I see that some of them check the order and canonicity of input public key and signature and some other not. Why this difference? Are these tests relevant ...
3
votes
1answer
638 views

libsodium x25519 and Ed25519 small order check

Studying libsodium implementation of x25519 and Ed25519 I saw that it performs an small order check comparing given inputs with a hard coded blacklist of values. Is this list exhaustive or it is a ...
0
votes
1answer
137 views

Encrypt or decrypt using the private key, and decrypt using the public key?

I am currently trying to figure out if my following scheme is implementable in ECC or whether I can use existing implementation. At first I was going with libsodium but it seems that it really doesn't ...
1
vote
1answer
582 views

Does “hash than sign paradigm” apply to ECDSA cryptography?

From wikipedia https://en.wikipedia.org/wiki/Digital_signature#How_they_work and other articles I see that: "There are several reasons to sign such a hash (or message digest) instead of the whole ...
3
votes
1answer
521 views

Is it safe to use same private key in two or more EC signature algorithms?

Given two (or more) algorithms: ed25519 private key is random blob of 32 bytes public key is encoded point on Edwards 25519 curve. ECDSA with secp256k1 private key is random blob of 32 bytes ...