Questions tagged [ed25519]
Ed25519 is an algorithm for producing digital signatures. The algorithm is based on Edwards curves introduced by Bernstein et al. (2007) and named after mathematician Harold M. Edwards.
44
questions
26
votes
1
answer
5k
views
Why are the lower 3 bits of curve25519/ed25519 secret keys cleared during creation?
I am currently experimenting with ed25519 and I noticed that on secret key creation, bit 254 is always set and the lower 3 bits are always cleared. I found that bit 254 is always set to protect ...
- 263
61
votes
3
answers
28k
views
Why Curve25519 for encryption but Ed25519 for signatures?
NaCl and libsodium libraries use Curve25519 for authenticated encryption (actually for sharing a key which is used for encryption) and Ed25519 for signatures. What is the purpose of using different ...
- 711
19
votes
1
answer
1k
views
Message-Recovery variant of Ed25519 signature?
What would be a Message-Recovery variant of the Ed25519 signature scheme?
Ed25519-MR should be simple to use, fast, with a strong security argument, and striving to stay out of the patent minefield, ...
- 138k
13
votes
1
answer
6k
views
Curve25519 over Ed25519 for key exchange? Why?
I've been reading up on the Signal Protocol (in this PDF) and it seems to be using Curve25519 for ECDH and EdDSA (with Ed25519) for signatures.
My question is why not use only Ed25519?
This ...
- 324
10
votes
2
answers
5k
views
Why are NaCl secret keys 64 bytes for signing, but 32 bytes for box?
Ed25519 secret and public keys can both be represented in 32 bytes. Why does NaCl use 64 byte signing keys?
- 4,712
20
votes
1
answer
4k
views
Using a single Ed25519 key for encryption and signature
The libsodium documentation contains a function crypto_sign_ed25519_pk_to_curve25519 that converts an Ed25519 key into a Curve25519 one, so it can be used for both ...
user2552
12
votes
2
answers
5k
views
Can curve25519 keys be used with ed25519 keys?
Can curve25519 keys be used with ed25519?
I'd prefer to use ed25519, but there isn't a fast java version. For my application, I'd like to use curve25519 until I can get a faster ed25519 for java.
...
user7024
9
votes
1
answer
3k
views
Base point in Ed25519?
The paper "High-speed high-security signatures" by Bernstein et al. introduces the Edwards curve Ed25519.
Concerning the base point $B$, it says that
$B$ is the unique point $(x, 4/5)\in E$ for ...
- 989
38
votes
1
answer
16k
views
ECDSA, EdDSA and ed25519 relationship / compatibility
I'm trying to understand the relationship between those three signature schemes (ECDSA, EdDSA, and ed25519) and mainly to what degree they are mutually compatible in the sense of key-pair derivation, ...
- 483
17
votes
1
answer
3k
views
Edwards / Montgomery ECC with Weierstrass Implementation?
So let's assume I want to perform Ed448 or Ed25519 digital signatures or want to perform a DH key-exchange. Assume further that those curves (Curve448 or Curve25519) are required.
But the problem is, ...
- 45.7k
18
votes
2
answers
11k
views
Difference between X25519 vs. Ed25519
I am reading https://en.wikipedia.org/wiki/Curve25519 and it states
Also in 2018, RFC 8446 was published as the new Transport Layer
Security v1.3 standard. It requires mandatory support for X25519,
...
- 611
9
votes
1
answer
1k
views
Ed25519 and hierarchical deterministic wallet
I'm building a solution based on the stellar codebase and using the Ed25519 curve for the signatures. One of the features I've been adding to the system is a support for hierarchical deterministic ...
8
votes
2
answers
2k
views
Is it possible to derive a public key from another public key without knowing a private key (Ed25519)?
I have a following use case:
User has his master public (pk) - private (sk) key pair (Ed25519).
In DB we store a public key.
Is ...
- 263
7
votes
2
answers
2k
views
libsodium x25519 and Ed25519 small order check
Studying libsodium implementation of x25519 and Ed25519 I saw that it performs an small order check comparing given inputs with a hard coded blacklist of values. Is this list exhaustive or it is a ...
- 593
1
vote
1
answer
1k
views
Does "hash than sign paradigm" apply to ECDSA cryptography?
From wikipedia https://en.wikipedia.org/wiki/Digital_signature#How_they_work
and other articles I see that: "There are several reasons to sign such a hash (or message digest) instead of the whole ...
- 113
33
votes
2
answers
14k
views
Elliptic curve ed25519 vs ed448 - Differences
Other than key size, What are some differences between the Elliptic curve ed25519 and ed448?
- 2,257
32
votes
5
answers
12k
views
Is it bad to expose the public key?
I am studying about blockchain and have been focusing on encryption protocols that allow authentication. The digital signature of public and private key seems solid, I have focused on the algorithm ...
- 439
10
votes
3
answers
2k
views
Curve 25519 (X25519, Ed25519) Convert coordinates between Montgomery curve and twisted Edwards curve
I have some misunderstanding about EdDSA conversion coordinates between Montgomery curve and twisted Edwards curve. In https://www.rfc-editor.org/rfc/rfc7748 I see that a base point for Curve25519 is
...
- 248
5
votes
1
answer
1k
views
Shor algorithm and schnorr signature in ed25519
Does the application of Shor's algorithm in any way relate/affect the schnorr signature in ed25519?
- 2,257
4
votes
1
answer
2k
views
Is it possible to derive an Ed25519-public-key from an Ed25519-signature?
If you have an Ed25519-signature and the signed message, can you derive the corresponding public-key or is the signature anonymous (except if you already know the public-key of course)?
- 578
2
votes
1
answer
1k
views
Can you derive ed25519 keys from secp256k1?
Alice has a secp256k1 key pair that she used some time ago when she communicated with Bob. Bob can no longer user secp256k1 but he only uses ed25519 instead.
Is there a secure algorithm that Bob can ...
- 135
2
votes
1
answer
804
views
Why does curve25519 use a cofactor of 8?
This cofactor (as I understand it) effectively discards valid points that satisfy the curve equation over the finite field.
Why would one wish to reduce the number of possible private keys, it seems ...
- 1,374
2
votes
2
answers
545
views
Should Ed25519 signature verification check the order and canonicity of its inputs?
Studying different implementations of Ed25519 I see that some of them check the order and canonicity of input public key and signature and some other not. Why this difference? Are these tests relevant ...
- 593
22
votes
1
answer
13k
views
How many qubits are required to break RSA 2048 or 4096 with a universal quantum computer?
So in the news this week, IBM have created a universal quantum computer with 5 fully functional qubits. Logic and Moore's law dictates they will be able to scale this up to a lot more qubits within a ...
- 231
12
votes
1
answer
3k
views
What are the differences between the elliptic curve equations?
I think we're all aware of the "classical" Weierstrass (short?) elliptic curve equation: $y^2\equiv x^3 + ax +b \pmod p$. Well known examples of these curves include the NIST's and Brainpool ones.
...
- 45.7k
12
votes
4
answers
6k
views
Is it possible to pick your Ed25519 public key?
Is it possible to generate an Ed25519 keypair that has a very similar public key as another keypair (fooling a casual visual comparison) or is this as hard as solving one of SHA-512 or the discrete ...
- 551
11
votes
1
answer
1k
views
HD (Hierarchical Deterministic) Keys using Safe Curves?
Bitcoin's HD (Hierarchical Deterministic) Keys as described in BIP32 allow for a master key to be created (a private key and a chain code) such that a tree of both public and private keys can be ...
9
votes
1
answer
2k
views
Why is EdDSA collision-resilient with SHA-512?
In the Bernstein et al. paper about EdDSA, the authors claim EdDSA is resilient against collisions (i.e. it can still be secure even if the hash function used isn't collision-resistant), drawing on a ...
- 3,567
9
votes
2
answers
3k
views
Raw curve25519 public key points
I'm trying to understand curve25519, and ECC public points.
I'm playing with Minisign, to better understand the fundamentals of ECC.
Minisign uses curve25519 and outputs public keys as base64 ...
- 1,374
8
votes
1
answer
2k
views
Does Ed25519 support cryptographic threshold signatures?
This is a loaded question so I'll list the concerns, not all of which need to be satisfied.
Does there exist a threshold-signature scheme for Ed25519 that...
Does not require a trusted dealer to set ...
- 125
8
votes
1
answer
1k
views
How to derive the curve Ed25519 from Curve25519?
According to the paper "Faster addition and doubling on elliptic curves" by Bernstein and Lange, the Montgomery curve (Curve25519) $$v^{2}=u^{3}+486662\cdot u^{2}+u$$ is birationally equivalent to the ...
- 989
8
votes
1
answer
3k
views
Converting Ed25519 public key to a Curve25519 public key
I understand that:
$$x_{montgomery} = \frac{1 + y_{edwards}}{1 - y_{edwards}}$$
Using the libsodium ed25519 implementation, I have tried to write the following:
...
user7868
7
votes
1
answer
2k
views
EdDSA (Ed25519) is any random number sufficient for a good private key?
Looking at a reference implementation it shows that the key pair generation simply does: read X bytes from RNG and then derive another value from these X bytes thus producing private key with derived ...
- 217
5
votes
2
answers
677
views
EdDSA Verification vs. Cofactorless Verification
In the EdDSA for more curve paper the authors defines:
Keys
An EdDSA secret key is a $b$-bit string $k$. The hash $H(k) = (h_0, h_1, ... , h_{2b−1})$ determines an integer $s = 2^n+\sum_{c≤i<n} ...
- 6,904
4
votes
2
answers
746
views
Converting a C25519 curve into a NIST-supported curve for FIPS crypto
If I have a cryptosystem based on C25519 ECC crypto, is it possible to use the same public/private key pairs for key agreement in a FIPS compliant way by deterministically converting C25519 public and ...
- 896
4
votes
1
answer
772
views
How can k3d3/ed25519-java's performance be improved?
I tried asking this on stackoverflow because I thought it might be a simple coding question and didn't want to clutter up this amazing stack, but I received no responses.
CodesInChaos showed me that ...
user7024
3
votes
1
answer
624
views
How Mutual authentication and Forward secrecy in The X3DH Key Agreement Protocol work?
Can someone explain the statement below from section 3.3 in The X3DH Key Agreement Protocol?
DH1 = DH(IKA, SPKB)
DH2 = DH(EKA, IKB)
DH3 = DH(EKA, SPKB)
DH4 = DH(EKA, OPKB)
SK = ...
- 257
3
votes
1
answer
1k
views
Is it safe to use same private key in two or more EC signature algorithms?
Given two (or more) algorithms:
ed25519
private key is random blob of 32 bytes
public key is encoded point on Edwards 25519 curve.
ECDSA with secp256k1
private key is random blob of 32 bytes
...
- 255
2
votes
2
answers
1k
views
Point addition and doubling in Ed25519 (ref10)?
I just migrated CodesInChaos' C# port of Ed25519(ref10) to Java, and everything works fine. (I.e. I get the same results for key generation, signature and verification.)
Now, I would like to do a ...
- 989
2
votes
1
answer
620
views
Ed25519 to X25519 transportation
Using
montgomeryX = (edwardsY + 1)*inverse(1 - edwardsY) mod p
it is possible to transport an Edwards curve point (Ed25519 ...
- 45
2
votes
2
answers
853
views
How do I multiply a Twisted Edwards point in Montgomery space?
EdDSA (and ed25519) signatures require a scalar multiplication. Currently, I do this directly in Twisted Edwards space. (The code can be found in my crypto library.) My research and my tests ...
1
vote
1
answer
348
views
Proof of possession. x25519 + ed25519
There are Client and Server.
Client have previously send public keys for x25519 and ed25519 to the server. And now need to prove that it has private keys for them.
I have found similar solutions in ...
1
vote
1
answer
1k
views
does TLS 1.3 use ECDSA-Sig-Value encoded signatures for Ed25519 / Ed448?
Quoting The Transport Layer Security (TLS) Protocol Version 1.3:
ECDSA algorithms Indicates a signature algorithm using ECDSA
[ECDSA], the corresponding curve as defined in ANSI X9.62 [X962]
and ...
- 2,895
0
votes
1
answer
455
views
Cryptographic notation in X3DH Key Agreement Protocol
Can someone please explain the below paragraphs from section 2.2 in The X3DH Key Agreement Protocol? Please try to explain the whole paragraphs.
1st paragraph:
I want to understand how the DH ...
- 257