Questions tagged [ed25519]

Ed25519 is an algorithm for producing digital signatures. The algorithm is based on Edwards curves introduced by Bernstein et al. (2007) and named after mathematician Harold M. Edwards.

Filter by
Sorted by
Tagged with
4 votes
1 answer
168 views

How are the unified addition formulae in extended twisted Edwards coordinates derived from the affine addition formulae?

I am trying to understand point addition in RFC8032 section 5.1.4, which references the paper "Twisted Edwards Curves Revisited" (https://eprint.iacr.org/2008/522.pdf) to describe the quick ...
3 votes
1 answer
245 views

Find Ed25519 Y Coordinate from X Coordinate

Are there any available formulas to determine a $Y$ coordinate given only an $X$ for the Ed25519 curve? The closest thing I've come to find is the recover_x(y, sign)...
2 votes
1 answer
98 views

In Ed25519, why not make both batch & unbatched verification follow the cofactored verification approach rather than unbatched using cofactorless?

Ed25519 uses a composite order Elliptic Curve (with a cofactor $8$) The algorithm however in the prime order subgroup of the main group. The signing operation should be using a generator/Base Point ...
  • 1,823
3 votes
2 answers
113 views

Ed25519 - Is there a reason to not trust the signer - i.e. can there be a dishonest signer?

Ed25519 uses a composite order Elliptic Curve but works in the prime order subgroup of the main group. The signing operation should be using a generator/Base Point from the prime order subgroup. This ...
  • 1,823
5 votes
3 answers
465 views

When working in a subgroup of EC in EdDSA (especially Ed255190), how is it OK to use operations different from that of the main group?

Ed25519 uses a composite order Elliptic Curve but works in the prime order subgroup of the main group. As per group theory, the subgroups use the group operation. However, as per this, Ed25519 ...
  • 1,823
0 votes
0 answers
37 views

Fast methods for adding the basepoint to an elliptic curve point?

Are there any clever (fast) methods for adding the basepoint (generator) to an arbitrary point on elliptic curve, finally ending in affine coordinates? I.e. if G is ...
1 vote
1 answer
93 views

Why Can't I Use an Nacl Sign Keypair for Encrypt and Decrypt Operations?

I'm aware that the difference between the NaCL sign keys vs the box keys is that the secret key that comes from the NaCL box keypair is the ...
0 votes
0 answers
47 views

Check if pubkey belongs to twisted Edwards25519

I want to check if some pubkey belongs to twisted edwards25519 (I guess this is used for ed25519 ?) The problem is that I have in theory some valid pubkeys like: ...
  • 103
0 votes
1 answer
183 views

Can OpenSSL sign an ED25519 certificate with ECDSA-with-SHA256?

We are trying to generate some self-signed certificates to test our cybersecurity firmware before switching to a "real" CA-signed chain of trust. The specification we are coding to mandates ...
0 votes
0 answers
60 views

Using ed22519 signature as entropy

I am developing an application in which all application state is entirely public. Each user of the application is equipped with their own ed22519 keypair, and the application can only ask users for ...
3 votes
2 answers
146 views

Isomorphism of Curve25519 and Ed25519?

According to this page, Curve25519 and Ed25519 are not isomorphic, because the birational equivalence equation has singularities: What does "birational equivalence" mean in a cryptographic ...
  • 2,308
2 votes
1 answer
203 views

What is a masked secret key in the conxt of Ed25519?

The documentation for Ed25519-dalek states the following for Secretkey: The caller is responsible for ensuring that the bytes represent a masked secret key. https://docs.rs/ed25519-dalek/0.3.2/...
1 vote
0 answers
30 views

Differing result between doubling and addition in extended twisted Edwards coordinates [closed]

While coding for Edwards curve, I noticed that, the addition formula and the doubling formula return what seems to be different result. I took the adding and doubling formula from both RFC-8032 and ...
  • 7,168
1 vote
1 answer
113 views

Test vectors (points) for Ed25519

I am trying to verify an Ed25519 implementation, but I can't find any test vectors for the curve points. All test vectors focus directly on signature constructions (EdDSA). I tried to use https://...
2 votes
1 answer
440 views

Generating and validating a signature with ED25519 expanded private key

I am building a encrypted messaging app over tor network and currently I'm struggling on using tor generated ed25519 private key to sign and verify any message. Below piece of code works with a 32 ...
  • 21
1 vote
0 answers
71 views

Collision-resistant single-pass EdDSA?

Is there any reason why collision resistant variants of ed25519 that use a single-pass aren't used instead? For example: $n = h(noncekey \| m)$ $h(R \| pub \| n)$ instead of $h(R \| pub \| m)$ or ...
2 votes
1 answer
170 views

Ed25519 to X25519 transportation

Using montgomeryX = (edwardsY + 1)*inverse(1 - edwardsY) mod p it is possible to transport an Edwards curve point (Ed25519 ...
  • 45
2 votes
1 answer
333 views

ed25519 attacks

I try to understand invalid curve attack and small subgroup attack. The lower 3 bits of a ed25519 private key are cleared to be a multiple by 8. So an attacker is unable to gain any information using ...
  • 45
0 votes
0 answers
37 views

Consequences of leaking one byte of an ECDH shared secret

An EC point $B$ is published publicly so that a recipient in possession of a scalar $a$ can calculate the shared secret $S = [a]B$. This is done with the Ed25519 curve. If the sender (who knows $b$ ...
  • 3,917
1 vote
0 answers
36 views

Is partial computation of an Ed25519 Diffie-Hellman shared secret possible?

Let's say we're using the Ed25519 curve, and we're computing a Diffie-Hellman shared secret EC point $S$ by scalar multiplication of scalar $a$ with EC point $B$. Is there any way of partially ...
  • 3,917
1 vote
0 answers
75 views

Is there a Ed25519 threshold signature protocol similar to the Gennaro-Goldfeder schema for ECDSA?

I keep searching online and asking in different cryptographic communities whether there is a similar threshold signature schema (or a close one) to what Gennaro and Goldfeder proposed for ECDSA? ...
  • 111
1 vote
0 answers
47 views

Birational transformation from Edwards curve with not square d to Edwards curve with square d

How can I transform a complete twisted Edwards curve $ax^2+y^2 = 1+dx^2y^2$ with not square $d$ and square $a$ into an isomorphic Edwards curve $X^2+Y^2 = 1+DX^2Y^2$ with a square $-D$ i.e. $D = -r^2$?...
  • 412
1 vote
0 answers
81 views

Should Ed25519 verification multiply by the cofactor?

The standardization document for Ed25519, RFC 8032, says the following method should be used for verifying Ed25519 signatures: Check the group equation $[8][S]B = [8]R + [8][k]A'$. It's sufficient, ...
  • 2,308
0 votes
0 answers
82 views

Why is the cofactor of the twisted Edwards curve equal to 8?

While The cofactor of the Edwards curve is chosen $4$ in standards, the cofactor of the twisted Edwards curve is chosen $8$. I can't understand the reason for this. Can we choose cofactor $4$ for the ...
3 votes
1 answer
324 views

Digital Signatures with Curve25519 key-pair

I have a public/private key pair of Curve25519 keys used by Wireguard. How can I use this keypair to generate/verify digital signatures? Preferrably, I would like to use EdDSA/Ed25519 but I struggle ...
1 vote
0 answers
56 views

ed25519 base point coordinates

For the ed25519 standard Base Point is $B = (x, 4/5)$. According to Stack Question the y coordinate equals ...
1 vote
2 answers
97 views

Why is implementation relevant to timing attacks?

Discussions from highly respected sources (details below) emphasize the importance of the implementation of cryptographic software to the effective security provided, with one particular case being ...
8 votes
2 answers
902 views

Why Elliptic Curve Cryptography protocols depend on fixed curves?

I'm learning about Ed25519. It depends on a bunch of magic values: The finite field of order $2^{255}-19$, the specific elliptic curve over that field, a specific ...
  • 181
0 votes
1 answer
184 views

How to securly save ED25519 private key on hard drive

I am developing an application which stores user's private Identity key (ed 25519) on user's hard drive without any security. What are the best practices / standards to save private key on hard drive, ...
1 vote
0 answers
83 views

Is it possible to apply the El Gamal encryption/decryption technique using Edwards curve in Montgomery form

I've been trying to understand the ElGamal encryption/decryption technique. I plan to use it for sending a private message to the server. That is: Alice needs to send $Pm$ (private message encoded via ...
1 vote
0 answers
68 views

Why does EDDSA secret scaler pruning not prevent values >= prime L or zero?

I have been exploring and studying the EDDSA algorithm for curve 25519 and curve 448 in RFC 8032 (https://www.rfc-editor.org/rfc/rfc8032) as well as for curves 414 and 521 from this (https://eprint....
1 vote
2 answers
355 views

Is it possible to unscramble a scrambled ed25519 SSH key?

Let's say I generate an ed25519 SSH key with ssh-keygen -t ed25519. Then I take the private key file and randomly scramble the order of base64 encoded characters. ...
  • 13
0 votes
1 answer
80 views

Why computation of $u*v^3*(u*v^7)^{(p-5)/8}$ is suggested instead of $(u/v)^{(p+3)/8}$

Working with Curve25519 I've faced with suggested form of computation square root candidate as: $uv^3(uv^7)^{\frac{p-5}{8}}$ instead of $\left(\frac{u}{v}\right)^{\frac{p+3}{8}}$. Why it is so? Or why ...
2 votes
1 answer
114 views

Ed25519 signature verification as described in RFC 8032

In RFC 8032, section 5.1.7, it is prescribed that an Ed25519 signature is verified if $[8][S]B = [8]R + [8][k]A'.$ The text then says It's sufficient, but not required, to instead check $[S]B = R + ...
  • 71
2 votes
1 answer
412 views

Test vectors for Ed25519

My apologies if this is obvious, but the truth is that I am confused about this. I am looking into RFC 8032 for test vectors for Ed25519, and I have some doubts concerning the information presented in ...
  • 71
1 vote
0 answers
67 views

Same Ed25519 key for signing and encryption? [duplicate]

I know this has been asked before, but it's still unclear whether this is an OK practice. The advice seems to never do this unless you have to, but I can think of some examples where this could be ...
  • 11
1 vote
0 answers
152 views

How do I convert an ed25519 scalar into x25519 for encryption?

In a system I'm working with, we're using Schnorr signatures with scalars generated with libsodium's crypto_core_ed25519_scalar_random. My goal is to use the ...
0 votes
1 answer
4k views

What is the public key length of RSA and Ed25519?

I have made some research but doesn't understand fully: In this link, it says ed25519 has a length of 64 characters. Questions: Is this base64 encoded characters? And does ed25519 limit to only 64 ...
  • 103
1 vote
1 answer
547 views

Encode ASN.1 PKCS#8 Private Key with Public Key and attributes

I'm trying to encode an Ed25519 private key as a PEM file based on this document https://www.rfc-editor.org/rfc/rfc8410#page-7 . I'm using an ASN.1 encoder written in Dart, and I can encode the ...
2 votes
1 answer
72 views

Compact ROM with space only for EdDSA. How to fit a key exchange algorithm inside?

I have implemented Ed25519 for a constrained-memory system, and I want to provide a Shared Secret functionality. The recommended method is to use X25519 for this; but then I would have to implement ...
  • 402
14 votes
2 answers
6k views

Difference between X25519 vs. Ed25519

I am reading https://en.wikipedia.org/wiki/Curve25519 and it states Also in 2018, RFC 8446 was published as the new Transport Layer Security v1.3 standard. It requires mandatory support for X25519, ...
  • 491
1 vote
0 answers
82 views

Difference and relation between ed25519, x25519 and XEd25519 [duplicate]

In my Rust implementation of a messaging system, I'm using currently two cryptographic primitives: ed25519_dalek and x25519_dalek. I use ed25519_dalek for DSA, while x25519_dalek for encryption of the ...
  • 235
3 votes
1 answer
216 views

Signature Generation Time vs Verification Time

When comparing the RSA-PSS signature algorithm with an elliptic curve based algorithm such as EdDSA, it is clear that signature verification takes less time for RSA than for EdDSA. For signature ...
  • 277
1 vote
1 answer
177 views

Point Matching Function for Curve 25519

Does anybody know a point-matching function for curve 25519? Or has a straight-forward way how to derive any arbitrary point-matching function? It should be like a reversible mapping from and to a 128+...
  • 105
9 votes
1 answer
5k views

Why are ed25519 keys not recommended for encryption?

Was wondering why there is no straightforward way of using ed25519 keys for encryption. Then I found this: https://github.com/indutny/elliptic/issues/108 There it is stated that it's unlike RSA not ...
  • 105
0 votes
0 answers
126 views

is it safe to do public key to public key derivation with Ed25519?

Deriving a public key from a public key in Ed25519 is possible, some algorithms are available. My question is why there are so few implementations compared to secp256k1 for example. The extra checks ...
0 votes
1 answer
486 views

Can the EdDSA signature scheme be customized with OpenSSL?

EdDSA has currently two signature schemes: Ed25519 and Ed448. Ed25519 is the EdDSA signature scheme using SHA-512 (SHA-2) and Curve25519 Ed448 is the EdDSA signature scheme using SHAKE256 (SHA-3) ...
  • 111
2 votes
1 answer
687 views

OID for Ed25519

I am working on a code generating Edwards curve (Ed25519) keys in a HSM using PKCS#11 API. In the public key template the CKA_EC_PARAMS uses an OID to specify the curve. The encoding for Ed25519 is ...
  • 23
0 votes
1 answer
74 views

Looking for feedback on the cryptographic design of my open source project: Bloom [closed]

I'm about to release the new version of my open source project: Bloom (encrypted Notes, Calendar, Contacts, Files…) which will feature end-to-end encryption. I've published the cryptographic details ...
user avatar
9 votes
1 answer
706 views

When using Ristretto or Decaf with Ed25519 and Ed448, do scalars still need pruning/trimming/clamping?

Decaf is a point compression method that builds a prime-order group for (twisted) Edwards curves and Montgomery curves with cofactor $h = 4$ based on the Jacobi quartic [H2015]. The promise is to ...
  • 659