Questions tagged [ed448]

In cryptography, Curve448 or Curve448-Goldilocks is an elliptic curve potentially offering 224 bits of security and designed for use with the elliptic-curve Diffie–Hellman (ECDH) key agreement scheme.

Filter by
Sorted by
Tagged with
33 votes
2 answers

Elliptic curve ed25519 vs ed448 - Differences

Other than key size, What are some differences between the Elliptic curve ed25519 and ed448?
1 vote
0 answers

Standard vs. specific mappings in SP800-186 for code reuse between different curve models

The final SP800-186 outlines mappings between Twisted Edwards and Montgomery curves, and between Montgomery and Weierstrass curves. These mappings are defined in Appendix B. Relationships Between ...
0 votes
1 answer

ed448 generator choice in supercop

Mike Hamburg proposed the Ed448-Goldilocks curve and submitted a software implementation for it to the SUPERCOP project. Below you can see that MH picked a generator (or base point) that has a y-...
2 votes
2 answers

How is the edwards448 generator derived from the curve448 generator in RFC 7748?

In RFC 7748, it is explained how the Montgomery curve, curve448, is deterministically generated from the prime $p = 2^{448} - 2^{224} - 1$. It is also explained how the generator (given below) for ...
4 votes
2 answers

Ed448 parameters wrong in RFC7748

When implementing and testing my own EdDSA program I found out that the old RFC7748 gives wrong parameters for Ed448/Edwards448. There is currently a new Draft were this is clarified: https://...
3 votes
1 answer

Curve448 - Can Ed448 key material be reused for X448?

Currently I am facing a situation in which Ed448 key pairs (private + public key) are available and the system should be extended by a Diffie-Hellman (ECDH) operation. First of let me summarize what I ...
4 votes
3 answers

Order of Edwards curve and its twist

In Mike Hamburg's Ed448-Goldilocks, a new elliptic curve (eprint 2015, WECCS 2015) it is studied untwisted Edwards curves in the prime field $\mathbb F_p$ $$E_d:\,y^2+x^2\,=\,1+d\,x^2\,y^2$$ with ...
1 vote
0 answers

Why does EDDSA secret scaler pruning not prevent values >= prime L or zero?

I have been exploring and studying the EDDSA algorithm for curve 25519 and curve 448 in RFC 8032 ( as well as for curves 414 and 521 from this (https://eprint....
3 votes
1 answer

Public key derivation for Ed448

Another potentially silly question here, but I seem to have developed tunnel vision and I am missing something very basic. In RFC 8032 one can find a number of test vectors for Ed488 - for example: <...
1 vote
1 answer

Performing EdDSA/Ed448 employing Montgomery ladder

EdDSA can be efficiently performed employing the Montgomery ladder. In order to implement this method, the base point should be converted to Mont. space, then the Mont. ladder should be executed, and ...
3 votes
1 answer

What is "spinal-tap grade" security?

As stated here Ed448 is different from Ed25519 because of "spinal-tap grade" security. What does this mean?