Questions tagged [ed25519]

Ed25519 is an algorithm for producing digital signatures. The algorithm is based on Edwards curves introduced by Bernstein et al. (2007) and named after mathematician Harold M. Edwards.

Filter by
Sorted by
Tagged with
47
votes
3answers
21k views

Why Curve25519 for encryption but Ed25519 for signatures?

NaCl and libsodium libraries use Curve25519 for authenticated encryption (actually for sharing a key which is used for encryption) and Ed25519 for signatures. What is the purpose of using different ...
10
votes
1answer
1k views

HD (Hierarchical Deterministic) Keys using Safe Curves?

Bitcoin's HD (Hierarchical Deterministic) Keys as described in BIP32 allow for a master key to be created (a private key and a chain code) such that a tree of both public and private keys can be ...
0
votes
1answer
214 views

Representing Ed25519 p curve in hexadecimal byte string

I am interested in representing p = 2^255 - 19 in the Ed255519 curve as hexadecimal byte representation. When I was looking through the original NaCL source code written by DJB, I saw a code fragment ...
4
votes
2answers
523 views

Converting a C25519 curve into a NIST-supported curve for FIPS crypto

If I have a cryptosystem based on C25519 ECC crypto, is it possible to use the same public/private key pairs for key agreement in a FIPS compliant way by deterministically converting C25519 public and ...
3
votes
1answer
401 views

How Mutual authentication and Forward secrecy in The X3DH Key Agreement Protocol work?

Can someone explain the statement below from section 3.3 in The X3DH Key Agreement Protocol? DH1 = DH(IKA, SPKB) DH2 = DH(EKA, IKB) DH3 = DH(EKA, SPKB) DH4 = DH(EKA, OPKB) SK = ...
0
votes
1answer
571 views

Deniability and Prekey Security in X3DH Key Agreement Protocol

Can someone please explain the below paragraphs from The X3DH Key Agreement Protocol? 1st paragraph: What is deniability and how does it work here? Deniability X3DH doesn't give either Alice ...
0
votes
1answer
342 views

Cryptographic notation in X3DH Key Agreement Protocol

Can someone please explain the below paragraphs from section 2.2 in The X3DH Key Agreement Protocol? Please try to explain the whole paragraphs. 1st paragraph: I want to understand how the DH ...
1
vote
1answer
181 views

Performance consideration in XEdDSA and VXEdDSA Signature Schemes

Can someone please explain the below paragraph from section 7 in The XEdDSA and VXEdDSA Signature Schemes? The below para states that we are hashing twice (I am not able to get that). How pre-hashing ...
0
votes
1answer
821 views

Hash functions in XEdDSA and VXEdDSA Signature Schemes

Can someone please explain the below paragraph from section 2.5 in The XEdDSA and VXEdDSA Signature Schemes? Specifically I want to understand how we are defining the family of hash functions and how ...
13
votes
1answer
1k views

Can I use signature(hash(message)) instead of signature(message)?

Background: We use the TweetNaCl crypto library by Bernstein (tweetnacl.cr.yp.to) et al and we would like to stick to it. However, we have the need to sign large messages and the library does not ...
0
votes
1answer
288 views

what is the maximum size of the payload data when using ed25519

When using ed25519 what is the maximum size of the message/payload data? From the specs: The Diffie-Hellman key exchange is then defined as follows: each party generates a random number 1 <= ...
17
votes
1answer
2k views

Edwards / Montgomery ECC with Weierstrass Implementation?

So let's assume I want to perform Ed448 or Ed25519 digital signatures or want to perform a DH key-exchange. Assume further that those curves (Curve448 or Curve25519) are required. But the problem is, ...
13
votes
1answer
3k views

Using a single Ed25519 key for encryption and signature

The libsodium documentation contains a function crypto_sign_ed25519_pk_to_curve25519 that converts an Ed25519 key into a Curve25519 one, so it can be used for both ...
1
vote
1answer
1k views

Generate keys with k3d3 / ed25519-java

I'm trying to use a java implementation of ed25519. In the code, I can't find any functions that generate keys. My experience with cryptography is limited to about three weeks of asking questions on ...
4
votes
1answer
685 views

How can k3d3/ed25519-java's performance be improved?

I tried asking this on stackoverflow because I thought it might be a simple coding question and didn't want to clutter up this amazing stack, but I received no responses. CodesInChaos showed me that ...
1
vote
1answer
144 views

byte length and offset for k3d3/ed25519 byte[] variables?

I've discovered for myself that java's BigInteger is very slow, so I'm trying to weakly optimize this java implementation of ed25519 which I will fork and post if ...
5
votes
1answer
450 views

EdDSA Verification vs. Cofactorless Verification

In the EdDSA for more curve paper the authors defines: Keys An EdDSA secret key is a $b$-bit string $k$. The hash $H(k) = (h_0, h_1, ... , h_{2b−1})$ determines an integer $s = 2^n+\sum_{c≤i<n} ...
5
votes
1answer
998 views

What is the best practices for storing ed25519 private keys which is used by nodes of my application to communicate with each other?

I am developing some kind of a p2p network where the nodes communicate with each other via TCP and each message is signed by ed25519 private key. I use libsodium for signing and signature verification....
3
votes
2answers
3k views

How to obtain 256-bit security from Ed25519?

It is said that breaking Ed25519 has similar difficulty to breaking RSA with ~3000-bit keys" 1 When using RSA, I prefer 4096-bit keys, but I would like to use Ed25519. If I wanted to double the ...
1
vote
1answer
200 views

Single-scalar multiplication with sign bit

I want to know if there's an "easy" timing-free way to compute the sign of $y$-coordinate of $r G$, for a secret scalar $r$ and $G$ the generator of an elliptic curve. We have several choices for ...
3
votes
1answer
609 views

Multiplying integers modulo $2^{255}-19$ using the Curve25519 polynomial reduction algorithm

I'm reading the Curve25519 paper and I see that in page 11, under the title "Multiplying integers modulo $2^{255}-19$", it says: The coefficients of $x^{10}$; $x^{11}$; ...; $x^{18}$ in $uv$ are ...
7
votes
1answer
448 views

Encoding scalar values to points on Ed25519

I'm interested exploring key derivation and threshold signature protocol that require point arithmetic (addition) on the private scalar values and $S$ values of the signatures in ed25519. ...
5
votes
1answer
118 views

Optimal same-base exponentiation?

I've (finally) implemented the answer to this question in our library, which stated how to transform montgomery curves (and points) to weierstrass curves (and points). Now, for scalar multiplication, ...
9
votes
1answer
393 views

Signature to prove of ownership of arbitrary sized data

I am familiar with public key signatures, but I was wondering if there is a method to accomplish the following. Suppose I publish a file (say a PDF article) on a peer to peer network. How can I ...
10
votes
4answers
5k views

Is it possible to pick your Ed25519 public key?

Is it possible to generate an Ed25519 keypair that has a very similar public key as another keypair (fooling a casual visual comparison) or is this as hard as solving one of SHA-512 or the discrete ...
7
votes
2answers
2k views

Is Curve25519 vulnerable to private key exposure in the case of a bad RNG?

I'm really excited by what I've learned of advancements in elliptic-curve cryptography. Curve25519 seems to be a great choice at this point in time, but if I recall correctly, some elliptic curve ...
0
votes
1answer
123 views

Trying to understand the constant factors (19 and 38) in Ed25519 ref10 function 'fe_mul'

I would like to transpose the Ed25519 ref10 implementation to a similar twisted Edwards curve that is based on another prime, in order to have the same speed optimizations in place for the new curve. ...
9
votes
1answer
2k views

Base point in Ed25519?

The paper "High-speed high-security signatures" by Bernstein et al. introduces the Edwards curve Ed25519. Concerning the base point $B$, it says that $B$ is the unique point $(x, 4/5)\in E$ for ...
9
votes
1answer
1k views

Why is EdDSA collision-resilient with SHA-512?

In the Bernstein et al. paper about EdDSA, the authors claim EdDSA is resilient against collisions (i.e. it can still be secure even if the hash function used isn't collision-resistant), drawing on a ...
6
votes
1answer
993 views

How to derive the curve Ed25519 from Curve25519?

According to the paper "Faster addition and doubling on elliptic curves" by Bernstein and Lange, the Montgomery curve (Curve25519) $$v^{2}=u^{3}+486662\cdot u^{2}+u$$ is birationally equivalent to the ...
8
votes
1answer
1k views

Does Ed25519 support cryptographic threshold signatures?

This is a loaded question so I'll list the concerns, not all of which need to be satisfied. Does there exist a threshold-signature scheme for Ed25519 that... Does not require a trusted dealer to set ...
4
votes
1answer
120 views

Is changing $H(R\mathbin{\Vert}A\mathbin{\Vert}M)$ to $H(R\mathbin{\Vert}A\mathbin{\Vert}H(M))$ in EdDSA secure?

EdDSA calculates $s=(r+H(R\mathbin{\Vert}A\mathbin{\Vert}M)\cdot a)\bmod\ell$ and $r=H(h\mathbin{\Vert}M)$, with $H$ being the hash function (SHA2/512); $B$ being the generator; $A$ being the public ...
7
votes
1answer
859 views

Isn't the security of EC curve 25519 126 bits?

The security of the EC25519 is given as 128 bits, but since the order of the group is 252 bits shouldn't the security be 126 bits? Given as half the magnitude of the underlying field, since DLP ...
2
votes
1answer
3k views

Is Curve25519-java secure?

I have only about 2 weeks of cryptography experience mostly in the form of questions on bitcoin.se. Is Curve25519-java up to date with current Curve25519 standards? Is Curve25519 itself secure? ...
6
votes
1answer
2k views

Converting Ed25519 public key to a Curve25519 public key

I understand that: $$x_{montgomery} = \frac{1 + y_{edwards}}{1 - y_{edwards}}$$ Using the libsodium ed25519 implementation, I have tried to write the following: ...
1
vote
1answer
198 views

Ed25519 with R replaced by H(RAM)?

Ed25519 signatures consist of $(R, s)$, where $s = r + H(RAM)a$ $mod$ $l$, and $R = rB$. This differs from the Schnorr signature where instead of $R$, the signature contains the hash $h=H(RAM)$. ...
2
votes
2answers
845 views

Point addition and doubling in Ed25519 (ref10)?

I just migrated CodesInChaos' C# port of Ed25519(ref10) to Java, and everything works fine. (I.e. I get the same results for key generation, signature and verification.) Now, I would like to do a ...
4
votes
1answer
1k views

Security benefits of Ed25519 generating signatures deterministically

I am reading on the Ed25519 curve, and I am trying to understand a claim. Here is the claim: Foolproof session keys. Signatures are generated deterministically; key generation consumes new ...
1
vote
0answers
116 views

Mapping integers to Ed25519 and back again?

I would like to map integer values to points on Ed25519, and then back again. Is there a technique that takes advantage of the specific structure of Ed25519?
5
votes
1answer
1k views

Non-standard signature security definition conforming ed25519 malleability

According to the paper “High-speed high-security signatures”… Malleability. We also see no relevance of "malleability" to the standard definition of signature security. Aside from the example, ...
2
votes
1answer
1k views

Is ed25519 a “hash signature”

Writing my last question, I saw the hash-signature tag. I tried to research it best I could, but I'm simply overwhelmed in this field. I don't think it means to simply hash data before signing, but ...
3
votes
1answer
574 views

Can a properly implemented ed25519 private key with public underlying data be cracked?

If the underlying data is public albeit hashed with SHA-512, does that make a difference on the strength of ed25519? Please quantify the extent. Can ed25519 be cracked after a certain amount of ...
21
votes
1answer
3k views

Why are the lower 3 bits of curve25519/ed25519 secret keys cleared during creation?

I am currently experimenting with ed25519 and I noticed that on secret key creation, bit 254 is always set and the lower 3 bits are always cleared. I found that bit 254 is always set to protect ...
2
votes
1answer
915 views

Is using Ed25519 parameters in ECDSA safe?

I recently discovered the Curve25519 key exchange lib and the Ed25519 signature lib. Due to the speculations about NIST-designed curves, there is a chance that I ditch them and use the curves above ...
10
votes
1answer
3k views

What signature schemes allow recovering the public key from a signature?

It seems to be possible to retrieve the (public) key used for creating an ECDSA signature just from the signature alone. This seems like an interesting property; as far as I know, RSA doesn't share ...
4
votes
1answer
1k views

Ed25519 choice of private key implementation

This answer to another question describes the different values chosen as private key and public key by various Ed25516 implementations. What are the advantages / disadvantages of each? (Table cropped ...

1 2
3