Questions tagged [ed25519]

Ed25519 is an algorithm for producing digital signatures. The algorithm is based on Edwards curves introduced by Bernstein et al. (2007) and named after mathematician Harold M. Edwards.

Filter by
Sorted by
Tagged with
0
votes
0answers
25 views

How can i derive eddsa (ed25519) public key, from private key using java [closed]

I am looking into https://github.com/str4d/ed25519-java library as well as some other libraries like bouncycastle, but am so far unsuccessful in generating public key. I am not interested in ...
2
votes
1answer
46 views

Compact ROM with space only for EdDSA. How to fit a key exchange algorithm inside?

I have implemented Ed25519 for a constrained-memory system, and I want to provide a Shared Secret functionality. The recommended method is to use X25519 for this; but then I would have to implement ...
2
votes
2answers
155 views

Difference between X25519 vs. Ed25519

I am reading https://en.wikipedia.org/wiki/Curve25519 and it states Also in 2018, RFC 8446 was published as the new Transport Layer Security v1.3 standard. It requires mandatory support for X25519, ...
1
vote
0answers
52 views

Difference and relation between ed25519, x25519 and XEd25519 [duplicate]

In my Rust implementation of a messaging system, I'm using currently two cryptographic primitives: ed25519_dalek and x25519_dalek. I use ed25519_dalek for DSA, while x25519_dalek for encryption of the ...
2
votes
1answer
60 views

Signature Generation Time vs Verification Time

When comparing the RSA-PSS signature algorithm with an elliptic curve based algorithm such as EdDSA, it is clear that signature verification takes less time for RSA than for EdDSA. For signature ...
1
vote
1answer
54 views

Point Matching Function for Curve 25519

Does anybody know a point-matching function for curve 25519? Or has a straight-forward way how to derive any arbitrary point-matching function? It should be like a reversible mapping from and to a 128+...
0
votes
1answer
264 views

Why are ed25519 keys not recommended for encryption?

Was wondering why there is no straightforward way of using ed25519 keys for encryption. Then I found this: https://github.com/indutny/elliptic/issues/108 There it is stated that it's unlike RSA not ...
0
votes
0answers
43 views

is it safe to do public key to public key derivation with Ed25519?

Deriving a public key from a public key in Ed25519 is possible, some algorithms are available. My question is why there are so few implementations compared to secp256k1 for example. The extra checks ...
0
votes
1answer
96 views

Can the EdDSA signature scheme be customized with OpenSSL?

EdDSA has currently 2 signature scheme Ed25519 and Ed448 where Ed25519 is the EdDSA signature scheme using SHA-512 (SHA-2) and Curve25519 Ed448 is the EdDSA signature scheme using SHAKE256 (SHA-3) ...
1
vote
1answer
89 views

OID for Ed25519

I am working on a code generating Edwards curve (Ed25519) keys in a HSM using PKCS#11 API. In the public key template the CKA_EC_PARAMS uses an OID to specify the curve. The encoding for Ed25519 is ...
0
votes
1answer
65 views

Looking for feedback on the cryptographic design of my open source project: Bloom [closed]

I'm about to release the new version of my open source project: Bloom (encrypted Notes, Calendar, Contacts, Files…) which will feature end-to-end encryption. I've published the cryptographic details ...
6
votes
1answer
203 views

When using Ristretto or Decaf with Ed25519 and Ed448, do scalars still need pruning/trimming/clamping?

Decaf is a point compression method that builds a prime-order group for (twisted) Edwards curves and Montgomery curves with cofactor $h = 4$ based on the Jacobi quartic [H2015]. The promise is to ...
0
votes
1answer
76 views

Why does ed25519 seem to accept and use 96-byte / 384-bit signatures?

Why do ed25519 signature verify functions accept 96-byte signatures? Take this piece of code for one example: crypto_sign_ed25519_open() requires that signatures be ...
0
votes
0answers
101 views

Comparisons of ECDSA, EdDSA and BLS Signatures in Blockchain: Pros and Cons

As we know, the most used digital scheme in Blockchain is ECDSA. For now, more and more blockchain projects, I've noticed, are considering substituting EdDSA and BLS signature scheme as the new one. ...
1
vote
1answer
291 views

Should I use NaCl or libsodium for my application?

While looking for end-to-end encryption for my app users, I stumbled upon NaCl and libsodium. I am unsure from a security perspective which of these implementations I should use for my cross-platform ...
1
vote
1answer
114 views

Proof of possession. x25519 + ed25519

There are Client and Server. Client have previously send public keys for x25519 and ed25519 to the server. And now need to prove that it has private keys for them. I have found similar solutions in ...
2
votes
1answer
103 views

Is the EdDSA signature scheme provable security?

The EdDSA signature scheme is a deterministic scheme. So could it be proven provable security in Random oracle model?
4
votes
1answer
141 views

Is Ed25519 really constant-time as widely implemented?

Despite the frequent claims that Ed25519 is more secure against side-channel attacks than (for instance) signatures performed over NIST P-256, I noticed that most implementations (including the ...
5
votes
2answers
286 views

Why does EdDSA require a b-bit private key instead of b/2-bit?

By design, EdDSA requires a $b$-bit string as the secret key $k$, and when signing, it is expanded to a $2b$-bit string $H(k)$, some bit-twiddling is done, and the first half is used as the private ...
1
vote
0answers
92 views

Does EdDSA share Schnorr signature secure linearity property?

EdDSA, Edwards-curve Digital Signature Algorithm (EdDSA) is a digital signature scheme using a variant of Schnorr signature based on Twisted Edwards curves (source). Schnorr signatures have a ...
1
vote
1answer
179 views

Key clamping in curve25519 not evident in generated key's binary representation

I understand with curve25519 that the private key for secret.box is clamped... I understand that this clamping process to clear ...
2
votes
1answer
198 views

Why does curve25519 use a cofactor of 8?

This cofactor (as I understand it) effectively discards valid points that satisfy the curve equation over the finite field. Why would one wish to reduce the number of possible private keys, it seems ...
0
votes
1answer
383 views

Securely derive AES and ED25519 keys from a ED25519 seed

Go's ed25519 package exposes a function which allows creating a private key from a 32 byte seed. See: https://godoc.org/golang.org/x/crypto/ed25519#NewKeyFromSeed The reason I want to use this is ...
0
votes
0answers
90 views

Possible to convert PGP ed25519 signature into signify-compatible format?

Both PGP and Signify (or Minisign) are capable of generating ED25519 detached signatures. Is it possible to convert a PGP-generated ED25519 signature into a signify-compatible format?
0
votes
1answer
136 views

How to check runtime of e.g. Ed25519 signature algorithm

As mentioned here the verification of a Ed25519 signature takes roughly 3 times as the time for the generation of a signature. Two questions on that: 1) Can I assume that this is a rule of thumb for ...
1
vote
2answers
509 views

Using public-key signature instead of having API key

I am designing an application that will need an API key. At first I believed that generating a long, random token would be secure enough (say 32 chars string that includes 0-9, a-z and A-Z), and then ...
6
votes
2answers
2k views

Raw curve25519 public key points

I'm trying to understand curve25519, and ECC public points. I'm playing with Minisign, to better understand the fundamentals of ECC. Minisign uses curve25519 and outputs public keys as base64 ...
5
votes
1answer
1k views

Difference between Pure EdDSA (ed25519) and HashEdDSA (ed25519ph)

My question refers to EdDSA as specified in RFC 8032. I get from the RFC that ed25519 and ed25519ph are two different instances of EdDSA mainly differing in the fact that that in the case of ...
1
vote
1answer
658 views

openssh ed2215 private key format

i have generated an ed2215 private key as follows: $ ssh-keygen -o -a 100 -t ed25519 -f id_ed25519 and it looks like ...
0
votes
1answer
196 views

Onion address encoding [closed]

Could you please explain what the pipe (|) in tor specification means -- is it a bitwise or or a concatenation of the values? Encoding onion addresses [...
3
votes
1answer
171 views

Why does Ed25519 scalar multiplication allow values larger than the subgroup order?

The GeScalarMultBase function is documented like so. From the way it is documented we see that it expects a little-endian value and has a precondition that constrains the range it accepts. ...
6
votes
0answers
590 views

Signal Protocol - Better way to generate one time pre keys (OTPK)

The following explains a different way (then one-time pre keys) for Bob to securely generate ephemeral keys asynchronously without a limit while still being able to delete the private key immediately ...
0
votes
1answer
162 views

Are EdDSA algorithms encoded by ASN.1 DER standards?

Is it required, or widely practiced to encode a EdDSA signature as a ASN.1 Sequence? Why or why not? How should you encode a EdDSA signature? I cannot find mention of DER or ASN in the EdDSA RFC. ...
2
votes
1answer
191 views

What is “spinal-tap grade” security?

As stated here Ed448 is different from Ed25519 because of "spinal-tap grade" security. What does this mean?
1
vote
1answer
106 views

Valid private keys on curve25519

Given that valid private keys on curve25519 must be less than the order of the curve which is (as I understand) already smaller than 2^256, AND a valid key must be clamped to be divisible by 8 and ...
0
votes
1answer
49 views

Is there a lower limit on message length for signature?

I was working on a tool that signs small messages (~20 bytes) when a question occurred about message size: What would be the risk of using extremely small/restricted input (say, 5 bytes of hexadecimal ...
2
votes
1answer
189 views

How can I avoid side channel attacks to scalar multiplication of Ed25519?

I'm a beginner of Edwards curve. And I'm trying to implement Ed25519 signature.There is python illustration at page 20. At the part of scalar multiplication it simply use double and add method: <...
0
votes
1answer
94 views

How to convert d into 64bit limbs? [closed]

Given a d value = -(10240/10241) How would I convert this into 64 bit limbs? I have to expand on this because of stackoverflow quality algorithm, I've tried using python to get the integer rep/hex ...
1
vote
1answer
78 views

Check if two ed25519 points are equivalent

How to check if two points are equivalent given their projective coordinates (XYTZ)? For example if I do unproject() of a point to pass from XYTZ to XY coordinates and then I come back to XYTZ ...
1
vote
1answer
268 views

Can you derive ed25519 keys from secp256k1?

Alice has a secp256k1 key pair that she used some time ago when she communicated with Bob. Bob can no longer user secp256k1 but he only uses ed25519 instead. Is there a secure algorithm that Bob can ...
1
vote
1answer
184 views

Converting EdDSA Keys to EC-KCDSA keys

I'm trying to create BIP32 like key derivation for EKCDSA by riding over a BIP32-EdDSA derivation Can anyone tell me if there is a glaring problem with my conversion technique? ...
7
votes
1answer
2k views

Curve25519 over Ed25519 for key exchange? Why?

I've been reading up on the Signal Protocol (in this PDF) and it seems to be using Curve25519 for ECDH and EdDSA (with Ed25519) for signatures. My question is why not use only Ed25519? This ...
8
votes
2answers
3k views

Elliptic curve ed25519 vs ed448 - Differences

Other than key size, What are some differences between the Elliptic curve ed25519 and ed448?
7
votes
2answers
887 views

Is it possible to derive a public key from another public key without knowing a private key (Ed25519)?

I have a following use case: User has his master public (sk) - private (pk) key pair (Ed25519). In DB we store a public key. Is ...
11
votes
1answer
254 views

How does the process of creating a new secure Elliptic Curve look like?

I'm especially curious about the technique djb would have used to come up with his Curve 25519. Say I have already written down my goals, such as - Twist Secure, Speed, Side Channel resistance, etc. ...
0
votes
1answer
236 views

ED25519 Child Key Derivation

Let's say I generate a keypair for a user with go's ed25519 package: pub, private := ed25519.GenerateKey(nil) And I want to generate additional child keys as ...
0
votes
0answers
628 views

ed25519 quantum resistant? [duplicate]

Is ed25519 quantum resistant? I am using ed25519 as a cryptographic primitive for decentralized identity platform, thus this very crucial question.
9
votes
3answers
1k views

Curve 25519 (X25519, Ed25519) Convert coordinates between Montgomery curve and twisted Edwards curve

I have some misunderstanding about EdDSA conversion coordinates between Montgomery curve and twisted Edwards curve. In https://tools.ietf.org/html/rfc7748 I see that a base point for Curve25519 is ...
0
votes
1answer
1k views

Verifying EdDSA signatures using xedDSA verify function.

I'm running into a problem where I generate signatures using a library like pynacl's (https://pynacl.readthedocs.io/en/stable/signing/) ed25519 implementation and then when I verify it using xedDSA's ...
4
votes
1answer
520 views

Ed25519 cryptanalysis and backdoor?

I am looking to implement Ed25519 for decentralized identity at scale. Has Ed25519 has gone through rigorous cryptanalysis? Could there be a backdoor in the algorithm?