Questions tagged [ed25519]
Ed25519 is an algorithm for producing digital signatures. The algorithm is based on Edwards curves introduced by Bernstein et al. (2007) and named after mathematician Harold M. Edwards.
198
questions
0
votes
0
answers
33
views
Ed25519 and sealed boxes libsodium
Accidentally used ed25519 public key to create libsoidum_sealed_box. Is there any way to decrypt the data if the private key ed25519 is known?
2
votes
1
answer
620
views
Ed25519 to X25519 transportation
Using
montgomeryX = (edwardsY + 1)*inverse(1 - edwardsY) mod p
it is possible to transport an Edwards curve point (Ed25519 ...
- 47.6k
5
votes
2
answers
814
views
Weaker alternative to Ed25519?
For me, the main advantages of Ed25519 are that it avoids patents (by computing in one dimension) and that it is fast.
However, the 128bit security of Ed25519 is sometimes too strong to comply with ...
- 729
4
votes
1
answer
1k
views
Ed25519 key generation
the following rfc describes the key-pair generation mechanism for Ed25519; the first two steps are as follows:
Hash the 32-byte private key using SHA-512, storing the digest in
a 64-octet large ...
- 103
1
vote
1
answer
98
views
Is it safe to derive Ed25519 and Kyber private keys from the same seed?
I am designing a Hybrid Key exchange library using x25519 and Kyber, and the scheme I have in mind is as follows:
Alice sending a file/message to Bob:
...
- 2,848
3
votes
1
answer
452
views
Current Digital Signature Standards as of late 2023
Is my summary understanding of current (classical) Digital signature standards essentially correct? I may be totally wrong.
DSA is no longer to be used for new signature generation just for checking ...
- 47.6k
0
votes
0
answers
96
views
A matching X25519 public from non-clamped Ed25519-public and Ed25519-secret
Given an Ed25519 key pair, can you think of any way to get to the same X25519 public key from the Ed25519 secret as from the non-clamped(!) Ed25519 public key?
...
2
votes
1
answer
79
views
What would be the security consequences of replacing $H(R, A, M)$ with $H(R, M)$ in EdDSA?
The question is mainly stated in the title. We don't consider any other changes to the scheme except for the following:
We replace $S = H(R,A,M) \cdot a + r$ with $S = H(R,M) \cdot a + r$.
My thoughts ...
- 878
1
vote
0
answers
18
views
Curious behavior of EVP_DigestSign for DKIM
Difficulties porting code to OpenSSL 3 may raise some doubts on digest signing. Before version 3 came, digest signing was the only way to use ED25519. On version 3, RSA_sign() being deprecated, I ...
- 111
18
votes
2
answers
11k
views
Difference between X25519 vs. Ed25519
I am reading https://en.wikipedia.org/wiki/Curve25519 and it states
Also in 2018, RFC 8446 was published as the new Transport Layer
Security v1.3 standard. It requires mandatory support for X25519,
...
CommunityBot
- 1
5
votes
1
answer
528
views
Why do Ed25519 use Twisted Edwards curve but not regular Edwards curve
I'm trying to understand benefits of using Twisted Edwards curve over regular Edwards curve. I'm aware of some properties of Twisted Edwards curve that regular Edwards curve missing like isomorphism ...
- 47.6k
13
votes
2
answers
14k
views
Why OpenSSH prefers ECDSA nistp256 keys over -384 and -521, and those over Ed25519, for host key verification?
According to ssh_config(5), HostKeyAlgorithms “specifies the host key algorithms that the client wants to use in order of ...
- 105
2
votes
1
answer
8k
views
What is the public key length of RSA and Ed25519?
I have made some research but doesn't understand fully:
In this link, it says ed25519 has a length of 64 characters.
Questions:
Is this base64 encoded characters?
And does ed25519 limit to only 64 ...
1
vote
0
answers
148
views
Edwards curve ed25519 puzzle
Recently a friend of mine showed me a "puzzle" he created with edwards curve ed25519
It is based on adding and multiplying points on the curve
You supply four arguments to the program
The '...
- 1
0
votes
0
answers
29
views
Academic papers for the pros and cons of password based system and digital signature with challenge and response system
I don't really know what should be the correct title for this and the community can correct it after reading.
I was the author of PKDSA (Searchable on github).
I have the idea to do it because I feel ...
- 125
0
votes
0
answers
54
views
Digital signature with challenge and respond with PQC
Can ECDSA signature signing and verification process replaces password hashed based login system?
The title of this question won't be exactly right.
This is a question that I asked long time ago. I ...
- 125
5
votes
1
answer
270
views
RFCs & IANA specs about Ed25519 inaccurate?
While designing a crypto system based on existing standards and specifications i find myself questioning some of the accuracy in the current RFC-8037 and IANA specs around Edwards curves, 25519 and ...
- 4,712
33
votes
2
answers
14k
views
Elliptic curve ed25519 vs ed448 - Differences
Other than key size, What are some differences between the Elliptic curve ed25519 and ed448?
- 138
4
votes
2
answers
2k
views
Could a C25519/ED25519 cryptographic module be FIPS certified?
NIST algorithms include ECDH and ECDSA. NIST also specifies curves. Is the use of NIST curves required for FIPS certification or could other curves theoretically be certified if someone were willing ...
- 111
10
votes
1
answer
788
views
Why Ed25519 encodes y-coordinates rather than x-coordinates
As stated in RFC8032 and FIPS 186-5, Ed25519 signatures uses the following encoding method:
A curve point (x,y), with coordinates in the range 0 <= x,y < p, is
coded as follows. First, encode ...
0
votes
2
answers
906
views
Computing PGP ed25519 and curve25519 keygrips?
There are public key algorithmic differences for how PGP computes fingerprints and keygrips. For the v4 protocol, fingerprints are not exclusively computed from public keys while keygrips are. RFC ...
CommunityBot
- 1
1
vote
0
answers
39
views
Standard vs. specific mappings in SP800-186 for code reuse between different curve models
The final SP800-186 outlines mappings between Twisted Edwards and Montgomery curves, and between Montgomery and Weierstrass curves.
These mappings are defined in Appendix B. Relationships Between ...
- 346
3
votes
1
answer
236
views
Breaking Ed25519 Discrete Logarithm with Degenerate Curve Attack
Following this question ed25519 attacks and also this paper on degenerate curve attacks https://eprint.iacr.org/2015/1233.pdf, I tried to implement my own attack: Given a point (0, y) and a scalar (k),...
- 12.4k
9
votes
2
answers
2k
views
How many valid X25519 private keys are there?
According to the Curve25519 website:
Computing secret keys. Inside your program, to generate a 32-byte Curve25519 secret key, start by generating 32 secret random bytes from a cryptographically safe ...
- 257
4
votes
2
answers
450
views
Deriving private keys from a signature/HSM
I have access to an HSM that can sign messages but doesn't have a way to expose the private key. The signatures are deterministic (RFC 6979). Another application only works with ed25519 signatures ...
- 91.7k
2
votes
1
answer
58
views
Which service provider can create (claimable) accounts for managing Ed25519 keypairs (zero-knowledge fashion) by email
The title is a mouthful, allow me to explain my situation.
I have a SaaS with many users.
When new users join the platform, I want to create a cryptographic keypair for them (Ed25519).
But I don't ...
- 878
6
votes
2
answers
448
views
"Cropping" the resulting shared secret from ECDH
I'm deriving a shared secret using ECDH with Ed25519 keys. According to the specification (page 5), the shared secret then can be any valid Curve25519 public key, i.e. any valid 32 bytes. My ...
- 2,565
3
votes
1
answer
212
views
Details about blind signature on ed25519
Recently, I started looking up for details about implementing a blind signature on ed25519 cryptographic. I saw this article https://stan.bar/blindsig/ by Stanislaw Baranski about it.
In the first ...
- 4,712
1
vote
1
answer
282
views
Why are hashing private key in Ed22519 key generation and later the modifications required?
In EdDSA with Ed25519 the algorithm of public key computing is following:
h = hash (privateKey)
h[0] &= 0xF8
h[31] &= 0x7F
h[31] |= 0x40
publicKey = h * B
...
- 452
4
votes
1
answer
234
views
How are the unified addition formulae in extended twisted Edwards coordinates derived from the affine addition formulae?
I am trying to understand point addition in RFC8032 section 5.1.4, which references the paper "Twisted Edwards Curves Revisited" (https://eprint.iacr.org/2008/522.pdf) to describe the quick ...
- 47.6k
3
votes
1
answer
586
views
Find Ed25519 Y Coordinate from X Coordinate
Are there any available formulas to determine a $Y$ coordinate given only an $X$ for the Ed25519 curve? The closest thing I've come to find is the recover_x(y, sign)...
- 67
2
votes
1
answer
178
views
In Ed25519, why not make both batch & unbatched verification follow the cofactored verification approach rather than unbatched using cofactorless?
Ed25519 uses a composite order Elliptic Curve (with a cofactor $8$) The algorithm however in the prime order subgroup of the main group. The signing operation should be using a generator/Base Point ...
- 2,169
3
votes
2
answers
152
views
Ed25519 - Is there a reason to not trust the signer - i.e. can there be a dishonest signer?
Ed25519 uses a composite order Elliptic Curve but works in the prime order subgroup of the main group. The signing operation should be using a generator/Base Point from the prime order subgroup.
This ...
- 929
5
votes
3
answers
670
views
When working in a subgroup of EC in EdDSA (especially Ed255190), how is it OK to use operations different from that of the main group?
Ed25519 uses a composite order Elliptic Curve but works in the prime order subgroup of the main group. As per group theory, the subgroups use the group operation.
However, as per this, Ed25519 ...
- 47.6k
0
votes
0
answers
141
views
Fast methods for adding the basepoint to an elliptic curve point?
Are there any clever (fast) methods for adding the basepoint (generator) to an arbitrary point on elliptic curve, finally ending in affine coordinates?
I.e. if G is ...
- 1
1
vote
1
answer
450
views
Why Can't I Use an Nacl Sign Keypair for Encrypt and Decrypt Operations?
I'm aware that the difference between the NaCL sign keys vs the box keys is that the secret key that comes from the NaCL box keypair is the ...
- 4,712
0
votes
0
answers
62
views
Check if pubkey belongs to twisted Edwards25519
I want to check if some pubkey belongs to twisted edwards25519 (I guess this is used for ed25519 ?) The problem is that I have in theory some valid pubkeys like:
...
- 103
2
votes
1
answer
2k
views
Can OpenSSL sign an ED25519 certificate with ECDSA-with-SHA256?
We are trying to generate some self-signed certificates to test our cybersecurity firmware before switching to a "real" CA-signed chain of trust. The specification we are coding to mandates ...
- 6,289
0
votes
1
answer
699
views
Comparisons of ECDSA, EdDSA and BLS Signatures in Blockchain: Pros and Cons
As we know, the most used digital scheme in Blockchain is ECDSA. For now, more and more blockchain projects, I've noticed, are considering substituting EdDSA and BLS signature scheme as the new one. ...
- 385
7
votes
1
answer
4k
views
Difference between Pure EdDSA (ed25519) and HashEdDSA (ed25519ph)
My question refers to EdDSA as specified in RFC 8032.
I get from the RFC that ed25519 and ed25519ph are two different instances of EdDSA mainly differing in the fact that that in the case of ed25519ph ...
- 168
0
votes
0
answers
111
views
Using ed22519 signature as entropy
I am developing an application in which all application state is entirely public. Each user of the application is equipped with their own ed22519 keypair, and the application can only ask users for ...
- 1,365
4
votes
2
answers
305
views
Isomorphism of Curve25519 and Ed25519?
According to this page, Curve25519 and Ed25519 are not isomorphic, because the birational equivalence equation has singularities:
What does "birational equivalence" mean in a cryptographic ...
- 2,513
2
votes
1
answer
273
views
What is a masked secret key in the conxt of Ed25519?
The documentation for Ed25519-dalek states the following for Secretkey:
The caller is responsible for ensuring that the bytes represent a masked secret key.
https://docs.rs/ed25519-dalek/0.3.2/...
- 4,712
20
votes
1
answer
4k
views
Using a single Ed25519 key for encryption and signature
The libsodium documentation contains a function crypto_sign_ed25519_pk_to_curve25519 that converts an Ed25519 key into a Curve25519 one, so it can be used for both ...
- 12k
1
vote
0
answers
61
views
Differing result between doubling and addition in extended twisted Edwards coordinates [closed]
While coding for Edwards curve, I noticed that, the addition formula and the doubling formula return what seems to be different result.
I took the adding and doubling formula from both RFC-8032 and ...
- 9,001
2
votes
1
answer
329
views
Test vectors (points) for Ed25519
I am trying to verify an Ed25519 implementation, but I can't find any test vectors for the curve points. All test vectors focus directly on signature constructions (EdDSA).
I tried to use https://...
- 4,712
2
votes
1
answer
3k
views
Generating and validating a signature with ED25519 expanded private key
I am building a encrypted messaging app over tor network and currently I'm struggling on using tor generated ed25519 private key to sign and verify any message.
Below piece of code works with a 32 ...
- 2,565
1
vote
0
answers
85
views
Collision-resistant single-pass EdDSA?
Is there any reason why collision resistant variants of ed25519 that use a single-pass aren't used instead? For example:
$n = h(noncekey \| m)$
$h(R \| pub \| n)$ instead of $h(R \| pub \| m)$
or ...
- 77
13
votes
1
answer
10k
views
Why are ed25519 keys not recommended for encryption?
Was wondering why there is no straightforward way of using ed25519 keys for encryption.
Then I found this: https://github.com/indutny/elliptic/issues/108
There it is stated that it's unlike RSA not ...
- 12k
61
votes
3
answers
28k
views
Why Curve25519 for encryption but Ed25519 for signatures?
NaCl and libsodium libraries use Curve25519 for authenticated encryption (actually for sharing a key which is used for encryption) and Ed25519 for signatures. What is the purpose of using different ...
- 47.6k