# Questions tagged [eddsa]

In public-key cryptography, Edwards-curve Digital Signature Algorithm (EdDSA) is a digital signature scheme using a variant of Schnorr signature based on twisted Edwards curves. It is designed to be faster than existing digital signature schemes without sacrificing security. It was developed by a team including Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, and Bo-Yin Yang. The reference implementation is public domain software.

23 questions
Filter by
Sorted by
Tagged with
65 views

### Is this half-smart way of verifying EdDSA signature secure?

In the final step of verifying an EdDSA signature, 4[S]B is compared to [4]R + [4][k]A. Because I'm using the XYTZ - extended ...
• 6,621
1 vote
67 views

### Collision-resistant single-pass EdDSA?

Is there any reason why collision resistant variants of ed25519 that use a single-pass aren't used instead? For example: $n = h(noncekey \| m)$ $h(R \| pub \| n)$ instead of $h(R \| pub \| m)$ or ...
• 77
94 views

### two closely distanced ECDSA keys

Assume that one uses two private keys $x_1$ and $x_2$ to generate two public ECDSA keys $y_1$ and $y_2$ (e.g., used as public key for Bitcoin address). The distance between $x_1$ and $x_2$ is small (e....
• 75
27 views

### EC implementation on Edward curves : what modulo is used in implementation?

I'm trying to implement EC scalar multiplication in the fastest way possible (but still with a good curve) on a GPU. I'm specifically looking to implement it based on https://github.com/Chair-for-...
• 101
68 views

### Why is the cofactor of the twisted Edwards curve equal to 8?

While The cofactor of the Edwards curve is chosen $4$ in standards, the cofactor of the twisted Edwards curve is chosen $8$. I can't understand the reason for this. Can we choose cofactor $4$ for the ...
238 views

### Digital Signatures with Curve25519 key-pair

I have a public/private key pair of Curve25519 keys used by Wireguard. How can I use this keypair to generate/verify digital signatures? Preferrably, I would like to use EdDSA/Ed25519 but I struggle ...
103 views

### Why does the EdDSA use a 2b-bit hash function?

The EdDSA signature of a message $M$ under key $k$ is created as: Define $r=H(h_b,....,h_{2b−1},M)\in\{0,1,...,2^{2b}−1\}$. Define $R=rB$. Define $S=(r+H(\underline R,\underline A,M)s)\bmod\ell$. ...
1 vote
66 views

### Why does EDDSA secret scaler pruning not prevent values >= prime L or zero?

I have been exploring and studying the EDDSA algorithm for curve 25519 and curve 448 in RFC 8032 (https://www.rfc-editor.org/rfc/rfc8032) as well as for curves 414 and 521 from this (https://eprint....
• 123
215 views

### Public key derivation for Ed448

Another potentially silly question here, but I seem to have developed tunnel vision and I am missing something very basic. In RFC 8032 one can find a number of test vectors for Ed488 - for example: <...
• 71
1 vote
50 views

### EdDSA point encoding difference between documentation and implementation

The RFC 8032 describes the point encoding like this : A curve point (x,y), with coordinates in the range 0 <= x,y < p, is coded as follows. First, encode the y-coordinate as a little-endian ...
• 47
272 views

### Rationale for verification with cofactor $2^c$ in EdDSA?

EdDSA for more curves describes two options of signature verification Verification, which checks $2^c\,S\,B\,=\,2^c\,R+2^c\,H(\underline R,\underline A,M)\,A$ Cofactorless verification, which checks \$...
• 124k
272 views

### Would EdDSA be broken by replacing H(R, A, M) with H(A, M)?

An EdDSA signature is (R, S) where R = r*B and S = r + H(R, A, M)*s. Notation from Wikipedia en.wikipedia.org/wiki/EdDSA. Given that the hash function H, is indeed collision-resistant, would using S = ...
382 views

### How is EdDSA different from ECDSA with a custom curve?

I just found this draft/informal IETF specification: Alternative Elliptic Curve Representation: This document specifies how to represent Montgomery curves and (twisted) Edwards curves as curves in ...
• 423
429 views

### Can the EdDSA signature scheme be customized with OpenSSL?

EdDSA has currently two signature schemes: Ed25519 and Ed448. Ed25519 is the EdDSA signature scheme using SHA-512 (SHA-2) and Curve25519 Ed448 is the EdDSA signature scheme using SHAKE256 (SHA-3) ...
• 111
274 views

### Likelihood of signature collision with EdDSA

Taking EdDSA as an example, given the length of a signature is 512-bits for a given data payload, what is the probability of a collision where there is another 512-bit value that is also a valid ...
• 1,222
1 vote
157 views

### What are the extended homogeneous coordinates in the EdDSA specification?

According to the EdDSA specification from the IETF: For point addition, the following method is recommended. A point (x,y) is represented in extended homogeneous coordinates (X, Y, Z, T), with x = X/...
• 223
259 views

### Does EdDSA share Schnorr signature secure linearity property?

EdDSA, Edwards-curve Digital Signature Algorithm (EdDSA), is a digital signature scheme using a variant of Schnorr signature based on Twisted Edwards curves (source). Schnorr signatures have a ...
163 views

### Generating a small EdDSA curve

I have an application that would benefit from very small (e.g., 16-20 byte) EdDSA keys and small signatures. It's an application where the goal is more to deter DOS attacks than "hard" ...
11k views

### What is the difference between ECDSA and EdDSA?

As I understand it, both work with elliptic curves, but there seems to be a difference as EdDSA is generally recommended over ECDSA.
• 253
14k views

### ECDSA, EdDSA and ed25519 relationship / compatibility

I'm trying to understand the relationship between those three signature schemes (ECDSA, EdDSA, and ed25519) and mainly to what degree they are mutually compatible in the sense of key-pair derivation, ...
405 views

### Is there any reason not to use EdDSA with Weierstrass curves?

I'm volunterely working for a crypto library and we're planning on adding Curve25519 support (finally). At the same point I had the idea of adding support for EdDSA in the same run. Our library is ...
• 44.6k