Cryptography

Questions tagged [ed25519]

Ask Question

Ed25519 is an algorithm for producing digital signatures. The algorithm is based on Edwards curves introduced by Bernstein et al. (2007) and named after mathematician Harold M. Edwards.

130 questions
Newest
Active
Bountied
Unanswered
Filter by
Sorted by
Tagged with
1
vote
1answer
29 views

OID for Ed25519

I am working on a code generating Edwards curve (Ed25519) keys in a HSM using PKCS#11 API. In the public key template the CKA_EC_PARAMS uses an OID to specify the curve. The encoding for Ed25519 is ...
7
votes
3answers
541 views

More efficient and just as secure to sign message hash using Ed25519?

According to the Ed25519 paper, the (potentially long) input message is hashed twice (see Section 4 page 12 steps 1 and 3). This webpage has a nice diagram toward the bottom that illustrates this, ...
0
votes
1answer
62 views

Looking for feedback on the cryptographic design of my open source project: Bloom [closed]

I'm about to release the new version of my open source project: Bloom (encrypted Notes, Calendar, Contacts, Files…) which will feature end-to-end encryption. I've published the cryptographic details ...
6
votes
2answers
2k views

Elliptic curve ed25519 vs ed448 - Differences

Other than key size, What are some differences between the Elliptic curve ed25519 and ed448?
5
votes
2answers
549 views

Weaker alternative to Ed25519?

For me, the main advantages of Ed25519 are that it avoids patents (by computing in one dimension) and that it is fast. However, the 128bit security of Ed25519 is sometimes too strong to comply with ...
5
votes
1answer
110 views

When using Ristretto or Decaf with Ed25519 and Ed448, do scalars still need pruning/trimming/clamping?

Decaf is a point compression method that builds a prime-order group for (twisted) Edwards curves and Montgomery curves with cofactor $h = 4$ based on the Jacobi quartic [H2015]. The promise is to ...
3
votes
1answer
137 views

Why does Ed25519 scalar multiplication allow values larger than the subgroup order?

The GeScalarMultBase function is documented like so. From the way it is documented we see that it expects a little-endian value and has a precondition that constrains the range it accepts. ...
18
votes
1answer
735 views

Message-Recovery variant of Ed25519 signature?

What would be a Message-Recovery variant of the Ed25519 signature scheme? Ed25519-MR should be simple to use, fast, with a strong security argument, and striving to stay out of the patent minefield, ...
0
votes
1answer
241 views

Securely derive AES and ED25519 keys from a ED25519 seed

Go's ed25519 package exposes a function which allows creating a private key from a 32 byte seed. See: https://godoc.org/golang.org/x/crypto/ed25519#NewKeyFromSeed The reason I want to use this is ...
0
votes
1answer
61 views

Why does ed25519 seem to accept and use 96-byte / 384-bit signatures?

Why do ed25519 signature verify functions accept 96-byte signatures? Take this piece of code for one example: crypto_sign_ed25519_open() requires that signatures be ...
8
votes
3answers
4k views

Can curve25519 keys be used with ed25519 keys?

Can curve25519 keys be used with ed25519? I'd prefer to use ed25519, but there isn't a fast java version. For my application, I'd like to use curve25519 until I can get a faster ed25519 for java. ...
1
vote
1answer
123 views

Should I use NaCl or libsodium for my application?

While looking for end-to-end encryption for my app users, I stumbled upon NaCl and libsodium. I am unsure from a security perspective which of these implementations I should use for my cross-platform ...
0
votes
0answers
34 views

Comparisons of ECDSA, EdDSA and BLS Signatures in Blockchain: Pros and Cons

As we know, the most used digital scheme in Blockchain is ECDSA. For now, more and more blockchain projects, I've noticed, are considering substituting EdDSA and BLS signature scheme as the new one. ...
2
votes
1answer
81 views

Is the EdDSA signature scheme provable security?

The EdDSA signature scheme is a deterministic scheme. So could it be proven provable security in Random oracle model?
1
vote
1answer
95 views

Proof of possession. x25519 + ed25519

There are Client and Server. Client have previously send public keys for x25519 and ed25519 to the server. And now need to prove that it has private keys for them. I have found similar solutions in ...
4
votes
1answer
127 views

Is Ed25519 really constant-time as widely implemented?

Despite the frequent claims that Ed25519 is more secure against side-channel attacks than (for instance) signatures performed over NIST P-256, I noticed that most implementations (including the ...
5
votes
2answers
275 views

Why does EdDSA require a b-bit private key instead of b/2-bit?

By design, EdDSA requires a $b$-bit string as the secret key $k$, and when signing, it is expanded to a $2b$-bit string $H(k)$, some bit-twiddling is done, and the first half is used as the private ...
8
votes
3answers
939 views

Curve 25519 (X25519, Ed25519) Convert coordinates between Montgomery curve and twisted Edwards curve

I have some misunderstanding about EdDSA conversion coordinates between Montgomery curve and twisted Edwards curve. In https://tools.ietf.org/html/rfc7748 I see that a base point for Curve25519 is ...
6
votes
0answers
504 views

Signal Protocol - Better way to generate one time pre keys (OTPK)

The following explains a different way (then one-time pre keys) for Bob to securely generate ephemeral keys asynchronously without a limit while still being able to delete the private key immediately ...
1
vote
0answers
56 views

Does EdDSA share Schnorr signature secure linearity property?

EdDSA, Edwards-curve Digital Signature Algorithm (EdDSA) is a digital signature scheme using a variant of Schnorr signature based on Twisted Edwards curves (source). Schnorr signatures have a ...
0
votes
1answer
118 views

Key clamping in curve25519 not evident in generated key's binary representation

I understand with curve25519 that the private key for secret.box is clamped... I understand that this clamping process to clear ...
1
vote
1answer
151 views

Why does curve25519 use a cofactor of 8?

This cofactor (as I understand it) effectively discards valid points that satisfy the curve equation over the finite field. Why would one wish to reduce the number of possible private keys, it seems ...
1
vote
2answers
214 views

Which US standard includes a signature based on Ed25519?

Which standard organization (e.g. NIST or ANSI) standardizes signature Ed25519?
4
votes
1answer
561 views

Could a C25519/ED25519 cryptographic module be FIPS certified?

NIST algorithms include ECDH and ECDSA. NIST also specifies curves. Is the use of NIST curves required for FIPS certification or could other curves theoretically be certified if someone were willing ...
0
votes
0answers
67 views

Possible to convert PGP ed25519 signature into signify-compatible format?

Both PGP and Signify (or Minisign) are capable of generating ED25519 detached signatures. Is it possible to convert a PGP-generated ED25519 signature into a signify-compatible format?
3
votes
1answer
454 views

Ed25519 key generation

the following rfc describes the key-pair generation mechanism for Ed25519; the first two steps are as follows: Hash the 32-byte private key using SHA-512, storing the digest in a 64-octet ...
0
votes
1answer
108 views

How to check runtime of e.g. Ed25519 signature algorithm

As mentioned here the verification of a Ed25519 signature takes roughly 3 times as the time for the generation of a signature. Two questions on that: 1) Can I assume that this is a rule of thumb for ...
1
vote
1answer
139 views

How are all necessary parameters shared between signer and verifier in the ED25519 signature scheme?

I want to use the ED25519 signature scheme in my application which requires frequent sharing of secret data between two entities in the public domain. I know that the Schnorr signature scheme has a ...
4
votes
1answer
458 views

Ed25519 cryptanalysis and backdoor?

I am looking to implement Ed25519 for decentralized identity at scale. Has Ed25519 has gone through rigorous cryptanalysis? Could there be a backdoor in the algorithm?
1
vote
2answers
262 views

Using public-key signature instead of having API key

I am designing an application that will need an API key. At first I believed that generating a long, random token would be secure enough (say 32 chars string that includes 0-9, a-z and A-Z), and then ...
6
votes
2answers
1k views

Raw curve25519 public key points

I'm trying to understand curve25519, and ECC public points. I'm playing with Minisign, to better understand the fundamentals of ECC. Minisign uses curve25519 and outputs public keys as base64 ...
5
votes
1answer
760 views

Difference between Pure EdDSA (ed25519) and HashEdDSA (ed25519ph)

My question refers to EdDSA as specified in RFC 8032. I get from the RFC that ed25519 and ed25519ph are two different instances of EdDSA mainly differing in the fact that that in the case of ...
1
vote
1answer
433 views

openssh ed2215 private key format

i have generated an ed2215 private key as follows: $ ssh-keygen -o -a 100 -t ed25519 -f id_ed25519 and it looks like ...
0
votes
1answer
142 views

Onion address encoding [closed]

Could you please explain what the pipe (|) in tor specification means -- is it a bitwise or or a concatenation of the values? Encoding onion addresses [...
6
votes
2answers
4k views

ed25519 ssh public key is always 80 characters long?

I am creating some ssh keys using ed25519, something like: ...
2
votes
1answer
168 views

What is “spinal-tap grade” security?

As stated here Ed448 is different from Ed25519 because of "spinal-tap grade" security. What does this mean?
0
votes
1answer
120 views

Are EdDSA algorithms encoded by ASN.1 DER standards?

Is it required, or widely practiced to encode a EdDSA signature as a ASN.1 Sequence? Why or why not? How should you encode a EdDSA signature? I cannot find mention of DER or ASN in the EdDSA RFC. ...
1
vote
1answer
641 views

Does “hash than sign paradigm” apply to ECDSA cryptography?

From wikipedia https://en.wikipedia.org/wiki/Digital_signature#How_they_work and other articles I see that: "There are several reasons to sign such a hash (or message digest) instead of the whole ...
2
votes
1answer
154 views

How can I avoid side channel attacks to scalar multiplication of Ed25519?

I'm a beginner of Edwards curve. And I'm trying to implement Ed25519 signature.There is python illustration at page 20. At the part of scalar multiplication it simply use double and add method: <...
1
vote
1answer
93 views

Valid private keys on curve25519

Given that valid private keys on curve25519 must be less than the order of the curve which is (as I understand) already smaller than 2^256, AND a valid key must be clamped to be divisible by 8 and ...
0
votes
1answer
46 views

Is there a lower limit on message length for signature?

I was working on a tool that signs small messages (~20 bytes) when a question occurred about message size: What would be the risk of using extremely small/restricted input (say, 5 bytes of hexadecimal ...
0
votes
1answer
82 views

How to convert d into 64bit limbs? [closed]

Given a d value = -(10240/10241) How would I convert this into 64 bit limbs? I have to expand on this because of stackoverflow quality algorithm, I've tried using python to get the integer rep/hex ...
1
vote
1answer
71 views

Check if two ed25519 points are equivalent

How to check if two points are equivalent given their projective coordinates (XYTZ)? For example if I do unproject() of a point to pass from XYTZ to XY coordinates and then I come back to XYTZ ...
1
vote
1answer
196 views

Can you derive ed25519 keys from secp256k1?

Alice has a secp256k1 key pair that she used some time ago when she communicated with Bob. Bob can no longer user secp256k1 but he only uses ed25519 instead. Is there a secure algorithm that Bob can ...
5
votes
1answer
890 views

EdDSA (Ed25519) is any random number sufficient for a good private key?

Looking at a reference implementation it shows that the key pair generation simply does: read X bytes from RNG and then derive another value from these X bytes thus producing private key with derived ...
1
vote
1answer
157 views

Converting EdDSA Keys to EC-KCDSA keys

I'm trying to create BIP32 like key derivation for EKCDSA by riding over a BIP32-EdDSA derivation Can anyone tell me if there is a glaring problem with my conversion technique? ...
4
votes
1answer
210 views

Edwards / Montgomery ECC over binary extension fields

I recentely had a discussion about the redesign of our ECC code for the library I'm collaborating on and the person I was discussing with came up with Edwards and Montgomery curves over binary ...
3
votes
1answer
511 views

Is modular Barrett reduction usable for Ed25519?

I currently try to implement Ed25519 following this draft. I have implemented every field operation except the reduction by the group order $q$ (in chapter 5). I looked for a reduction algorithm and ...
4
votes
1answer
384 views

Are the first 4 bytes of a Ed25519 public key random?

We are using the Ed25519 signature scheme (which uses Curve25519). A key pair is generated by generating the secret key from random data and then computing the 32-byte (256-bit) public key from said ...
6
votes
1answer
2k views

Curve25519 over Ed25519 for key exchange? Why?

I've been reading up on the Signal Protocol (in this PDF) and it seems to be using Curve25519 for ECDH and EdDSA (with Ed25519) for signatures. My question is why not use only Ed25519? This ...

1
2 3