Questions tagged [ed25519]
Ed25519 is an algorithm for producing digital signatures. The algorithm is based on Edwards curves introduced by Bernstein et al. (2007) and named after mathematician Harold M. Edwards.
205
questions
64
votes
3
answers
29k
views
Why Curve25519 for encryption but Ed25519 for signatures?
NaCl and libsodium libraries use Curve25519 for authenticated encryption (actually for sharing a key which is used for encryption) and Ed25519 for signatures. What is the purpose of using different ...
- 741
39
votes
1
answer
17k
views
ECDSA, EdDSA and ed25519 relationship / compatibility
I'm trying to understand the relationship between those three signature schemes (ECDSA, EdDSA, and ed25519) and mainly to what degree they are mutually compatible in the sense of key-pair derivation, ...
- 493
36
votes
2
answers
16k
views
Elliptic curve ed25519 vs ed448 - Differences
Other than key size, What are some differences between the Elliptic curve ed25519 and ed448?
- 2,277
32
votes
5
answers
13k
views
Is it bad to expose the public key?
I am studying about blockchain and have been focusing on encryption protocols that allow authentication. The digital signature of public and private key seems solid, I have focused on the algorithm ...
- 439
27
votes
1
answer
5k
views
Why are the lower 3 bits of curve25519/ed25519 secret keys cleared during creation?
I am currently experimenting with ed25519 and I noticed that on secret key creation, bit 254 is always set and the lower 3 bits are always cleared. I found that bit 254 is always set to protect ...
- 273
22
votes
1
answer
13k
views
How many qubits are required to break RSA 2048 or 4096 with a universal quantum computer?
So in the news this week, IBM have created a universal quantum computer with 5 fully functional qubits. Logic and Moore's law dictates they will be able to scale this up to a lot more qubits within a ...
- 231
20
votes
1
answer
5k
views
Using a single Ed25519 key for encryption and signature
The libsodium documentation contains a function crypto_sign_ed25519_pk_to_curve25519 that converts an Ed25519 key into a Curve25519 one, so it can be used for both ...
user2552
19
votes
2
answers
12k
views
Difference between X25519 vs. Ed25519
I am reading https://en.wikipedia.org/wiki/Curve25519 and it states
Also in 2018, RFC 8446 was published as the new Transport Layer
Security v1.3 standard. It requires mandatory support for X25519,
...
- 631
19
votes
1
answer
1k
views
Message-Recovery variant of Ed25519 signature?
What would be a Message-Recovery variant of the Ed25519 signature scheme?
Ed25519-MR should be simple to use, fast, with a strong security argument, and striving to stay out of the patent minefield, ...
- 141k
18
votes
1
answer
3k
views
Edwards / Montgomery ECC with Weierstrass Implementation?
So let's assume I want to perform Ed448 or Ed25519 digital signatures or want to perform a DH key-exchange. Assume further that those curves (Curve448 or Curve25519) are required.
But the problem is, ...
- 46k
14
votes
1
answer
6k
views
Curve25519 over Ed25519 for key exchange? Why?
I've been reading up on the Signal Protocol (in this PDF) and it seems to be using Curve25519 for ECDH and EdDSA (with Ed25519) for signatures.
My question is why not use only Ed25519?
This ...
- 344
14
votes
2
answers
20k
views
ed25519 ssh public key is always 80 characters long?
I am creating some ssh keys using ed25519, something like:
...
- 255
14
votes
1
answer
12k
views
Why are ed25519 keys not recommended for encryption?
Was wondering why there is no straightforward way of using ed25519 keys for encryption.
Then I found this: https://github.com/indutny/elliptic/issues/108
There it is stated that it's unlike RSA not ...
- 163
13
votes
4
answers
6k
views
Is it possible to pick your Ed25519 public key?
Is it possible to generate an Ed25519 keypair that has a very similar public key as another keypair (fooling a casual visual comparison) or is this as hard as solving one of SHA-512 or the discrete ...
- 561
13
votes
2
answers
16k
views
Why OpenSSH prefers ECDSA nistp256 keys over -384 and -521, and those over Ed25519, for host key verification?
According to ssh_config(5), HostKeyAlgorithms “specifies the host key algorithms that the client wants to use in order of ...
- 331
13
votes
1
answer
1k
views
Can I use signature(hash(message)) instead of signature(message)?
Background:
We use the TweetNaCl crypto library by Bernstein (tweetnacl.cr.yp.to) et al and we would like to stick to it. However, we have the need to sign large messages and the library does not ...
- 375
12
votes
2
answers
5k
views
Can curve25519 keys be used with ed25519 keys?
Can curve25519 keys be used with ed25519?
I'd prefer to use ed25519, but there isn't a fast java version. For my application, I'd like to use curve25519 until I can get a faster ed25519 for java.
...
user7024
12
votes
1
answer
4k
views
What are the differences between the elliptic curve equations?
I think we're all aware of the "classical" Weierstrass (short?) elliptic curve equation: $y^2\equiv x^3 + ax +b \pmod p$. Well known examples of these curves include the NIST's and Brainpool ones.
...
- 46k
12
votes
1
answer
4k
views
What signature schemes allow recovering the public key from a signature?
It seems to be possible to retrieve the (public) key used for creating an ECDSA signature just from the signature alone.
This seems like an interesting property; as far as I know, RSA doesn't share ...
- 1,798
11
votes
2
answers
5k
views
Why are NaCl secret keys 64 bytes for signing, but 32 bytes for box?
Ed25519 secret and public keys can both be represented in 32 bytes. Why does NaCl use 64 byte signing keys?
- 4,732
11
votes
1
answer
315
views
How does the process of creating a new secure Elliptic Curve look like?
I'm especially curious about the technique djb would have used to come up with his Curve 25519. Say I have already written down my goals, such as - Twist Secure, Speed, Side Channel resistance, etc. ...
- 213
11
votes
1
answer
1k
views
HD (Hierarchical Deterministic) Keys using Safe Curves?
Bitcoin's HD (Hierarchical Deterministic) Keys as described in BIP32 allow for a master key to be created (a private key and a chain code) such that a tree of both public and private keys can be ...
10
votes
3
answers
2k
views
Curve 25519 (X25519, Ed25519) Convert coordinates between Montgomery curve and twisted Edwards curve
I have some misunderstanding about EdDSA conversion coordinates between Montgomery curve and twisted Edwards curve. In https://www.rfc-editor.org/rfc/rfc7748 I see that a base point for Curve25519 is
...
- 248
10
votes
1
answer
873
views
Why Ed25519 encodes y-coordinates rather than x-coordinates
As stated in RFC8032 and FIPS 186-5, Ed25519 signatures uses the following encoding method:
A curve point (x,y), with coordinates in the range 0 <= x,y < p, is
coded as follows. First, encode ...
- 2,836
10
votes
1
answer
1k
views
When using Ristretto or Decaf with Ed25519 and Ed448, do scalars still need pruning/trimming/clamping?
Decaf is a point compression method that builds a prime-order group for (twisted) Edwards curves and Montgomery curves with cofactor $h = 4$ based on the Jacobi quartic [H2015]. The promise is to ...
- 231
10
votes
1
answer
469
views
Signature to prove of ownership of arbitrary sized data
I am familiar with public key signatures, but I was wondering if there is a method to accomplish the following.
Suppose I publish a file (say a PDF article) on a peer to peer network. How can I ...
- 101
9
votes
2
answers
4k
views
Raw curve25519 public key points
I'm trying to understand curve25519, and ECC public points.
I'm playing with Minisign, to better understand the fundamentals of ECC.
Minisign uses curve25519 and outputs public keys as base64 ...
- 1,384
9
votes
2
answers
2k
views
Is it possible to derive a public key from another public key without knowing a private key (Ed25519)?
I have a following use case:
User has his master public (pk) - private (sk) key pair (Ed25519).
In DB we store a public key.
Is ...
- 273
9
votes
2
answers
2k
views
How many valid X25519 private keys are there?
According to the Curve25519 website:
Computing secret keys. Inside your program, to generate a 32-byte Curve25519 secret key, start by generating 32 secret random bytes from a cryptographically safe ...
- 257
9
votes
1
answer
1k
views
Isn't the security of EC curve 25519 126 bits?
The security of the EC25519 is given as 128 bits, but since the order of the group is 252 bits shouldn't the security be 126 bits? Given as half the magnitude of the underlying field, since DLP ...
- 235
9
votes
1
answer
3k
views
Base point in Ed25519?
The paper "High-speed high-security signatures" by Bernstein et al. introduces the Edwards curve Ed25519.
Concerning the base point $B$, it says that
$B$ is the unique point $(x, 4/5)\in E$ for ...
- 989
9
votes
1
answer
2k
views
Why is EdDSA collision-resilient with SHA-512?
In the Bernstein et al. paper about EdDSA, the authors claim EdDSA is resilient against collisions (i.e. it can still be secure even if the hash function used isn't collision-resistant), drawing on a ...
- 3,587
9
votes
1
answer
1k
views
Ed25519 and hierarchical deterministic wallet
I'm building a solution based on the stellar codebase and using the Ed25519 curve for the signatures. One of the features I've been adding to the system is a support for hierarchical deterministic ...
8
votes
2
answers
994
views
Why Elliptic Curve Cryptography protocols depend on fixed curves?
I'm learning about Ed25519. It depends on a bunch of magic values: The finite field of order $2^{255}-19$, the specific elliptic curve over that field, a specific ...
- 181
8
votes
3
answers
1k
views
More efficient and just as secure to sign message hash using Ed25519?
According to the Ed25519 paper, the (potentially long) input message is hashed twice (see Section 4 page 12 steps 1 and 3). This webpage has a nice diagram toward the bottom that illustrates this, ...
- 151
8
votes
1
answer
1k
views
How to derive the curve Ed25519 from Curve25519?
According to the paper "Faster addition and doubling on elliptic curves" by Bernstein and Lange, the Montgomery curve (Curve25519) $$v^{2}=u^{3}+486662\cdot u^{2}+u$$ is birationally equivalent to the ...
- 989
8
votes
1
answer
3k
views
Converting Ed25519 public key to a Curve25519 public key
I understand that:
$$x_{montgomery} = \frac{1 + y_{edwards}}{1 - y_{edwards}}$$
Using the libsodium ed25519 implementation, I have tried to write the following:
...
user7868
8
votes
1
answer
2k
views
Does Ed25519 support cryptographic threshold signatures?
This is a loaded question so I'll list the concerns, not all of which need to be satisfied.
Does there exist a threshold-signature scheme for Ed25519 that...
Does not require a trusted dealer to set ...
- 125
7
votes
2
answers
3k
views
Is Curve25519 vulnerable to private key exposure in the case of a bad RNG?
I'm really excited by what I've learned of advancements in elliptic-curve cryptography. Curve25519 seems to be a great choice at this point in time, but if I recall correctly, some elliptic curve ...
- 967
7
votes
2
answers
2k
views
libsodium x25519 and Ed25519 small order check
Studying libsodium implementation of x25519 and Ed25519 I saw that it performs an small order check comparing given inputs with a hard coded blacklist of values. Is this list exhaustive or it is a ...
- 603
7
votes
1
answer
2k
views
Ed25519 PKCS8 private key example from IETF draft seems malformed
Malformed PKCS8 Key
Algorithm Identifiers for Ed25519, Ed448, X25519 and X448 for use in the Internet X.509 Public Key Infrastructure § 10.3. Examples of Ed25519 Private Key states the following:
<...
- 2,927
7
votes
1
answer
2k
views
EdDSA (Ed25519) is any random number sufficient for a good private key?
Looking at a reference implementation it shows that the key pair generation simply does: read X bytes from RNG and then derive another value from these X bytes thus producing private key with derived ...
- 217
7
votes
1
answer
5k
views
Difference between Pure EdDSA (ed25519) and HashEdDSA (ed25519ph)
My question refers to EdDSA as specified in RFC 8032.
I get from the RFC that ed25519 and ed25519ph are two different instances of EdDSA mainly differing in the fact that that in the case of ed25519ph ...
- 391
7
votes
1
answer
1k
views
Non-standard signature security definition conforming ed25519 malleability
According to the paper “High-speed high-security signatures”…
Malleability. We also see no relevance of "malleability" to the standard definition of signature security.
Aside from the example, ...
user7024
7
votes
1
answer
693
views
Encoding scalar values to points on Ed25519
I'm interested exploring key derivation and threshold signature protocol that require point arithmetic (addition) on the private scalar values and $S$ values of the signatures in ed25519.
...
- 171
7
votes
0
answers
1k
views
Signal Protocol - Better way to generate one time pre keys (OTPK)
The following explains a different way (then one-time pre keys) for Bob to securely generate ephemeral keys asynchronously without a limit while still being able to delete the private key immediately ...
- 344
6
votes
2
answers
1k
views
Ed25519 cryptanalysis and backdoor?
I am looking to implement Ed25519 for decentralized identity at scale.
Has Ed25519 has gone through rigorous cryptanalysis?
Could there be a backdoor in the algorithm?
- 2,277
6
votes
2
answers
509
views
"Cropping" the resulting shared secret from ECDH
I'm deriving a shared secret using ECDH with Ed25519 keys. According to the specification (page 5), the shared secret then can be any valid Curve25519 public key, i.e. any valid 32 bytes. My ...
user80785
6
votes
1
answer
3k
views
Is every bytestring a valid Ed25519 private key?
In other words, is it a bad idea to simply do this?
signingkey = crypto_random_bytes();
verifykey = Ed25519.verifykey_from_signingkey(signingkey);
Are there weak ...
- 2,389
6
votes
1
answer
622
views
Why do Ed25519 use Twisted Edwards curve but not regular Edwards curve
I'm trying to understand benefits of using Twisted Edwards curve over regular Edwards curve. I'm aware of some properties of Twisted Edwards curve that regular Edwards curve missing like isomorphism ...
- 429