Questions tagged [ed25519]
Ed25519 is an algorithm for producing digital signatures. The algorithm is based on Edwards curves introduced by Bernstein et al. (2007) and named after mathematician Harold M. Edwards.
28
questions with no upvoted or accepted answers
7
votes
0
answers
1k
views
Signal Protocol - Better way to generate one time pre keys (OTPK)
The following explains a different way (then one-time pre keys) for Bob to securely generate ephemeral keys asynchronously without a limit while still being able to delete the private key immediately ...
- 324
4
votes
0
answers
531
views
Does EdDSA share Schnorr signature secure linearity property?
EdDSA, Edwards-curve Digital Signature Algorithm (EdDSA), is a digital signature scheme using a variant of Schnorr signature based on Twisted Edwards curves (source).
Schnorr signatures have a ...
- 263
2
votes
0
answers
145
views
Is there a Ed25519 threshold signature protocol similar to the Gennaro-Goldfeder schema for ECDSA?
I keep searching online and asking in different cryptographic communities whether there is a similar threshold signature schema (or a close one) to what Gennaro and Goldfeder proposed for ECDSA?
...
- 121
2
votes
0
answers
123
views
Is it possible to apply the El Gamal encryption/decryption technique using Edwards curve in Montgomery form
I've been trying to understand the ElGamal encryption/decryption technique. I plan to use it for sending a private message to the server. That is: Alice needs to send $Pm$ (private message encoded via ...
2
votes
0
answers
294
views
Ed25519 threshold signature verification without knowing the single personal public keys
I read about ways to create a t-of-n threshold signature, corresponding to a collective public key of n players. (https://datatracker.ietf.org/doc/html/draft-ford-cfrg-cosi-00 and Does Ed25519 support ...
- 21
2
votes
0
answers
716
views
Curve25519 / Ed25519 - Generate a private key from this term
I have 2 key pairs $(x_1, y_1)$, $(x_2, y_2)$.
I also have $a = $random 256-bit array and $b = $256-bit of defined values from me.
I know the values for $(x_1, y_1)$, $x_2$ and $b$. But I miss the ...
- 31
1
vote
0
answers
18
views
Curious behavior of EVP_DigestSign for DKIM
Difficulties porting code to OpenSSL 3 may raise some doubts on digest signing. Before version 3 came, digest signing was the only way to use ED25519. On version 3, RSA_sign() being deprecated, I ...
- 111
1
vote
0
answers
148
views
Edwards curve ed25519 puzzle
Recently a friend of mine showed me a "puzzle" he created with edwards curve ed25519
It is based on adding and multiplying points on the curve
You supply four arguments to the program
The '...
- 11
1
vote
0
answers
39
views
Standard vs. specific mappings in SP800-186 for code reuse between different curve models
The final SP800-186 outlines mappings between Twisted Edwards and Montgomery curves, and between Montgomery and Weierstrass curves.
These mappings are defined in Appendix B. Relationships Between ...
- 346
1
vote
0
answers
85
views
Collision-resistant single-pass EdDSA?
Is there any reason why collision resistant variants of ed25519 that use a single-pass aren't used instead? For example:
$n = h(noncekey \| m)$
$h(R \| pub \| n)$ instead of $h(R \| pub \| m)$
or ...
- 77
1
vote
0
answers
44
views
Is partial computation of an Ed25519 Diffie-Hellman shared secret possible?
Let's say we're using the Ed25519 curve, and we're computing a Diffie-Hellman shared secret EC point $S$ by scalar multiplication of scalar $a$ with EC point $B$.
Is there any way of partially ...
- 4,712
1
vote
0
answers
56
views
Birational transformation from Edwards curve with not square d to Edwards curve with square d
How can I transform a complete twisted Edwards curve $ax^2+y^2 = 1+dx^2y^2$ with not square $d$ and square $a$ into an isomorphic Edwards curve $X^2+Y^2 = 1+DX^2Y^2$ with a square $-D$ i.e. $D = -r^2$?...
- 548
1
vote
0
answers
185
views
Should Ed25519 verification multiply by the cofactor?
The standardization document for Ed25519, RFC 8032, says the following method should be used for verifying Ed25519 signatures:
Check the group equation $[8][S]B = [8]R + [8][k]A'$. It's sufficient, ...
- 2,513
1
vote
0
answers
88
views
ed25519 base point coordinates
For the ed25519 standard Base Point is $B = (x, 4/5)$. According to Stack Question the y coordinate equals
...
- 141
1
vote
0
answers
93
views
Why does EDDSA secret scaler pruning not prevent values >= prime L or zero?
I have been exploring and studying the EDDSA algorithm for curve 25519 and curve 448 in RFC 8032 (https://www.rfc-editor.org/rfc/rfc8032) as well as for curves 414 and 521 from this (https://eprint....
- 307
1
vote
0
answers
248
views
How do I convert an ed25519 scalar into x25519 for encryption?
In a system I'm working with, we're using Schnorr signatures with scalars generated with libsodium's crypto_core_ed25519_scalar_random.
My goal is to use the ...
- 113
1
vote
0
answers
253
views
Possible to convert PGP ed25519 signature into signify-compatible format?
Both PGP and Signify (or Minisign) are capable of generating ED25519 detached signatures. Is it possible to convert a PGP-generated ED25519 signature into a signify-compatible format?
- 111
1
vote
0
answers
725
views
Is Deterministic Ed25519 Key Derivation from Master Key and String Secure?
I am wanting to make deterministic (i.e. always the same for the same inputs) Ed25519 key from a master Ed25519 key and a target string (e.g. a website name, ala SQRL). My algorithm takes a 32-byte ...
- 111
1
vote
0
answers
129
views
Mapping integers to Ed25519 and back again?
I would like to map integer values to points on Ed25519, and then back again.
Is there a technique that takes advantage of the specific structure of Ed25519?
- 989
0
votes
0
answers
33
views
Ed25519 and sealed boxes libsodium
Accidentally used ed25519 public key to create libsoidum_sealed_box. Is there any way to decrypt the data if the private key ed25519 is known?
0
votes
0
answers
96
views
A matching X25519 public from non-clamped Ed25519-public and Ed25519-secret
Given an Ed25519 key pair, can you think of any way to get to the same X25519 public key from the Ed25519 secret as from the non-clamped(!) Ed25519 public key?
...
0
votes
0
answers
29
views
Academic papers for the pros and cons of password based system and digital signature with challenge and response system
I don't really know what should be the correct title for this and the community can correct it after reading.
I was the author of PKDSA (Searchable on github).
I have the idea to do it because I feel ...
- 125
0
votes
0
answers
54
views
Digital signature with challenge and respond with PQC
Can ECDSA signature signing and verification process replaces password hashed based login system?
The title of this question won't be exactly right.
This is a question that I asked long time ago. I ...
- 125
0
votes
0
answers
141
views
Fast methods for adding the basepoint to an elliptic curve point?
Are there any clever (fast) methods for adding the basepoint (generator) to an arbitrary point on elliptic curve, finally ending in affine coordinates?
I.e. if G is ...
- 1
0
votes
0
answers
62
views
Check if pubkey belongs to twisted Edwards25519
I want to check if some pubkey belongs to twisted edwards25519 (I guess this is used for ed25519 ?) The problem is that I have in theory some valid pubkeys like:
...
- 103
0
votes
0
answers
111
views
Using ed22519 signature as entropy
I am developing an application in which all application state is entirely public. Each user of the application is equipped with their own ed22519 keypair, and the application can only ask users for ...
0
votes
0
answers
140
views
Why is the cofactor of the twisted Edwards curve equal to 8?
While The cofactor of the Edwards curve is chosen $4$ in standards, the cofactor of the twisted Edwards curve is chosen $8$. I can't understand the reason for this. Can we choose cofactor $4$ for the ...
- 482
0
votes
0
answers
194
views
is it safe to do public key to public key derivation with Ed25519?
Deriving a public key from a public key in Ed25519 is possible, some algorithms are available. My question is why there are so few implementations compared to secp256k1 for example. The extra checks ...
- 101