Questions tagged [ed25519]
Ed25519 is an algorithm for producing digital signatures. The algorithm is based on Edwards curves introduced by Bernstein et al. (2007) and named after mathematician Harold M. Edwards.
144
questions
6
votes
1answer
358 views
Is there any reason not to use EdDSA with Weierstrass curves?
I'm volunterely working for a crypto library and we're planning on adding Curve25519 support (finally). At the same point I had the idea of adding support for EdDSA in the same run.
Our library is ...
0
votes
1answer
155 views
Can the EdDSA signature scheme be customized with OpenSSL?
EdDSA has currently two signature schemes: Ed25519 and Ed448.
Ed25519 is the EdDSA signature scheme using SHA-512 (SHA-2) and Curve25519
Ed448 is the EdDSA signature scheme using SHAKE256 (SHA-3) ...
2
votes
1answer
26 views
Ed25519 signature verification as described in RFC 8032
In RFC 8032, section 5.1.7, it is prescribed that an Ed25519 signature is verified if
$[8][S]B = [8]R + [8][k]A'.$
The text then says
It's sufficient, but not required, to instead check $[S]B = R + ...
7
votes
2answers
924 views
Is it possible to derive a public key from another public key without knowing a private key (Ed25519)?
I have a following use case:
User has his master public (pk) - private (sk) key pair (Ed25519).
In DB we store a public key.
Is ...
26
votes
1answer
12k views
ECDSA, EdDSA and ed25519 relationship / compatibility
I'm trying to understand the relationship between those three signature schemes (ECDSA, EdDSA, and ed25519) and mainly to what degree they are mutually compatible in the sense of key-pair derivation, ...
1
vote
0answers
124 views
Does EdDSA share Schnorr signature secure linearity property?
EdDSA, Edwards-curve Digital Signature Algorithm (EdDSA), is a digital signature scheme using a variant of Schnorr signature based on Twisted Edwards curves (source).
Schnorr signatures have a ...
2
votes
1answer
57 views
Test vectors for Ed25519
My apologies if this is obvious, but the truth is that I am confused about this.
I am looking into RFC 8032 for test vectors for Ed25519, and I have some doubts concerning the information presented in ...
1
vote
0answers
43 views
Same Ed25519 key for signing and encryption? [duplicate]
I know this has been asked before, but it's still unclear whether this is an OK practice. The advice seems to never do this unless you have to, but I can think of some examples where this could be ...
2
votes
1answer
225 views
How can I avoid side channel attacks to scalar multiplication of Ed25519?
I'm a beginner at working with Edwards Curves, and I'm trying to implement an Ed25519 signature. I have a question from a text. Please see the illustration below (in Python).
At the part of scalar ...
1
vote
0answers
41 views
How do I convert an ed25519 scalar into x25519 for encryption?
In a system I'm working with, we're using Schnorr signatures with scalars generated with libsodium's crypto_core_ed25519_scalar_random.
My goal is to use the ...
0
votes
1answer
107 views
What is the public key length of RSA and Ed25519?
I have made some research but doesn't understand fully:
In this link, it says ed25519 has a length of 64 characters.
Questions:
Is this base64 encoded characters?
And does ed25519 limit to only 64 ...
1
vote
1answer
37 views
Encode ASN.1 PKCS#8 Private Key with Public Key and attributes
I'm trying to encode an Ed25519 private key as a PEM file based on this document https://tools.ietf.org/html/rfc8410#page-7 .
I'm using an ASN.1 encoder written in Dart, and I can encode the private ...
1
vote
2answers
305 views
Should Ed25519 signature verification check the order and canonicity of its inputs?
Studying different implementations of Ed25519 I see that some of them check the order and canonicity of input public key and signature and some other not. Why this difference? Are these tests relevant ...
5
votes
2answers
993 views
libsodium x25519 and Ed25519 small order check
Studying libsodium implementation of x25519 and Ed25519 I saw that it performs an small order check comparing given inputs with a hard coded blacklist of values. Is this list exhaustive or it is a ...
5
votes
2answers
621 views
Ed25519 cryptanalysis and backdoor?
I am looking to implement Ed25519 for decentralized identity at scale.
Has Ed25519 has gone through rigorous cryptanalysis?
Could there be a backdoor in the algorithm?
3
votes
2answers
678 views
Encoding Public Keys
We would like to encode ECDSA Public Key specifically keys generated using the ed25519 for storage .
What is the best and less error prone method , for now we think about using Hex strings or Base64 ...
2
votes
1answer
52 views
Compact ROM with space only for EdDSA. How to fit a key exchange algorithm inside?
I have implemented Ed25519 for a constrained-memory system, and I want to provide a Shared Secret functionality. The recommended method is to use X25519 for this; but then I would have to implement ...
3
votes
2answers
608 views
Difference between X25519 vs. Ed25519
I am reading https://en.wikipedia.org/wiki/Curve25519 and it states
Also in 2018, RFC 8446 was published as the new Transport Layer
Security v1.3 standard. It requires mandatory support for X25519,
...
4
votes
1answer
2k views
Is every bytestring a valid Ed25519 private key?
In other words, is it a bad idea to simply do this?
signingkey = crypto_random_bytes();
verifykey = Ed25519.verifykey_from_signingkey(signingkey);
Are there weak ...
1
vote
0answers
60 views
Difference and relation between ed25519, x25519 and XEd25519 [duplicate]
In my Rust implementation of a messaging system, I'm using currently two cryptographic primitives: ed25519_dalek and x25519_dalek. I use ed25519_dalek for DSA, while x25519_dalek for encryption of the ...
2
votes
1answer
71 views
Signature Generation Time vs Verification Time
When comparing the RSA-PSS signature algorithm with an elliptic curve based algorithm such as EdDSA, it is clear that signature verification takes less time for RSA than for EdDSA. For signature ...
1
vote
1answer
59 views
Point Matching Function for Curve 25519
Does anybody know a point-matching function for curve 25519?
Or has a straight-forward way how to derive any arbitrary point-matching function?
It should be like a reversible mapping from and to a 128+...
2
votes
1answer
800 views
Why are ed25519 keys not recommended for encryption?
Was wondering why there is no straightforward way of using ed25519 keys for encryption.
Then I found this: https://github.com/indutny/elliptic/issues/108
There it is stated that it's unlike RSA not ...
0
votes
1answer
445 views
Securely derive AES and ED25519 keys from a ED25519 seed
Go's ed25519 package exposes a function which allows creating a private key from a 32 byte seed.
See: https://godoc.org/golang.org/x/crypto/ed25519#NewKeyFromSeed
The reason I want to use this is ...
0
votes
0answers
45 views
is it safe to do public key to public key derivation with Ed25519?
Deriving a public key from a public key in Ed25519 is possible, some algorithms are available. My question is why there are so few implementations compared to secp256k1 for example. The extra checks ...
5
votes
2answers
604 views
Weaker alternative to Ed25519?
For me, the main advantages of Ed25519 are that it avoids patents (by computing in one dimension) and that it is fast.
However, the 128bit security of Ed25519 is sometimes too strong to comply with ...
2
votes
2answers
616 views
How do I multiply a Twisted Edwards point in Montgomery space?
EdDSA (and ed25519) signatures require a scalar multiplication. Currently, I do this directly in Twisted Edwards space. (The code can be found in my crypto library.) My research and my tests ...
1
vote
1answer
131 views
OID for Ed25519
I am working on a code generating Edwards curve (Ed25519) keys in a HSM using PKCS#11 API. In the public key template the CKA_EC_PARAMS uses an OID to specify the curve. The encoding for Ed25519 is ...
8
votes
3answers
629 views
More efficient and just as secure to sign message hash using Ed25519?
According to the Ed25519 paper, the (potentially long) input message is hashed twice (see Section 4 page 12 steps 1 and 3). This webpage has a nice diagram toward the bottom that illustrates this, ...
0
votes
1answer
69 views
Looking for feedback on the cryptographic design of my open source project: Bloom [closed]
I'm about to release the new version of my open source project: Bloom (encrypted Notes, Calendar, Contacts, Filesā¦) which will feature end-to-end encryption.
I've published the cryptographic details ...
11
votes
2answers
4k views
Elliptic curve ed25519 vs ed448 - Differences
Other than key size, What are some differences between the Elliptic curve ed25519 and ed448?
6
votes
1answer
260 views
When using Ristretto or Decaf with Ed25519 and Ed448, do scalars still need pruning/trimming/clamping?
Decaf is a point compression method that builds a prime-order group for (twisted) Edwards curves and Montgomery curves with cofactor $h = 4$ based on the Jacobi quartic [H2015]. The promise is to ...
3
votes
1answer
193 views
Why does Ed25519 scalar multiplication allow values larger than the subgroup order?
The GeScalarMultBase function is documented like so. From the way it is documented we see that it expects a little-endian value and has a precondition that constrains the range it accepts.
...
18
votes
1answer
771 views
Message-Recovery variant of Ed25519 signature?
What would be a Message-Recovery variant of the Ed25519 signature scheme?
Ed25519-MR should be simple to use, fast, with a strong security argument, and striving to stay out of the patent minefield, ...
0
votes
1answer
87 views
Why does ed25519 seem to accept and use 96-byte / 384-bit signatures?
Why do ed25519 signature verify functions accept 96-byte signatures? Take this piece of code for one example: crypto_sign_ed25519_open() requires that signatures be ...
10
votes
2answers
4k views
Can curve25519 keys be used with ed25519 keys?
Can curve25519 keys be used with ed25519?
I'd prefer to use ed25519, but there isn't a fast java version. For my application, I'd like to use curve25519 until I can get a faster ed25519 for java.
...
1
vote
1answer
562 views
Should I use NaCl or libsodium for my application?
While looking for end-to-end encryption for my app users, I stumbled upon NaCl and libsodium. I am unsure from a security perspective which of these implementations I should use for my cross-platform ...
0
votes
0answers
159 views
Comparisons of ECDSA, EdDSA and BLS Signatures in Blockchain: Pros and Cons
As we know, the most used digital scheme in Blockchain is ECDSA. For now, more and more blockchain projects, I've noticed, are considering substituting EdDSA and BLS signature scheme as the new one. ...
2
votes
1answer
115 views
Is the EdDSA signature scheme provable security?
The EdDSA signature scheme is a deterministic scheme. So could it be proven provable security in Random oracle model?
1
vote
1answer
126 views
Proof of possession. x25519 + ed25519
There are Client and Server.
Client have previously send public keys for x25519 and ed25519 to the server. And now need to prove that it has private keys for them.
I have found similar solutions in ...
3
votes
1answer
147 views
Is Ed25519 really constant-time as widely implemented?
Despite the frequent claims that Ed25519 is more secure against side-channel attacks than (for instance) signatures performed over NIST P-256, I noticed that most implementations (including the ...
5
votes
2answers
291 views
Why does EdDSA require a b-bit private key instead of b/2-bit?
By design, EdDSA requires a $b$-bit string as the secret key $k$, and when signing, it is expanded to a $2b$-bit string $H(k)$, some bit-twiddling is done, and the first half is used as the private ...
9
votes
3answers
1k views
Curve 25519 (X25519, Ed25519) Convert coordinates between Montgomery curve and twisted Edwards curve
I have some misunderstanding about EdDSA conversion coordinates between Montgomery curve and twisted Edwards curve. In https://tools.ietf.org/html/rfc7748 I see that a base point for Curve25519 is
...
7
votes
0answers
717 views
Signal Protocol - Better way to generate one time pre keys (OTPK)
The following explains a different way (then one-time pre keys) for Bob to securely generate ephemeral keys asynchronously without a limit while still being able to delete the private key immediately ...
1
vote
1answer
198 views
Key clamping in curve25519 not evident in generated key's binary representation
I understand with curve25519 that the private key for secret.box is clamped...
I understand that this clamping process to clear ...
2
votes
1answer
241 views
Why does curve25519 use a cofactor of 8?
This cofactor (as I understand it) effectively discards valid points that satisfy the curve equation over the finite field.
Why would one wish to reduce the number of possible private keys, it seems ...
1
vote
2answers
225 views
Which US standard includes a signature based on Ed25519?
Which standard organization (e.g. NIST or ANSI) standardizes signature Ed25519?
4
votes
1answer
833 views
Could a C25519/ED25519 cryptographic module be FIPS certified?
NIST algorithms include ECDH and ECDSA. NIST also specifies curves. Is the use of NIST curves required for FIPS certification or could other curves theoretically be certified if someone were willing ...
0
votes
0answers
117 views
Possible to convert PGP ed25519 signature into signify-compatible format?
Both PGP and Signify (or Minisign) are capable of generating ED25519 detached signatures. Is it possible to convert a PGP-generated ED25519 signature into a signify-compatible format?
3
votes
1answer
548 views
Ed25519 key generation
the following rfc describes the key-pair generation mechanism for Ed25519; the first two steps are as follows:
Hash the 32-byte private key using SHA-512, storing the digest in
a 64-octet ...