Questions tagged [eddsa]

In public-key cryptography, Edwards-curve Digital Signature Algorithm (EdDSA) is a digital signature scheme using a variant of Schnorr signature based on twisted Edwards curves. It is designed to be faster than existing digital signature schemes without sacrificing security. It was developed by a team including Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, and Bo-Yin Yang. The reference implementation is public domain software.

Filter by
Sorted by
Tagged with
2 votes
1 answer
79 views

What would be the security consequences of replacing $H(R, A, M)$ with $H(R, M)$ in EdDSA?

The question is mainly stated in the title. We don't consider any other changes to the scheme except for the following: We replace $S = H(R,A,M) \cdot a + r$ with $S = H(R,M) \cdot a + r$. My thoughts ...
tur11ng's user avatar
  • 878
0 votes
1 answer
58 views

Reason for two random numbers in DSA?

Why is the signature in DSA the way it is? I am referring to $r$ and $k$ in the Signing-Algorithm depicted below. Is it really necessary to have both, $r$ and $s$, or would it still be secure if only ...
cryptoQueen's user avatar
5 votes
1 answer
270 views

RFCs & IANA specs about Ed25519 inaccurate?

While designing a crypto system based on existing standards and specifications i find myself questioning some of the accuracy in the current RFC-8037 and IANA specs around Edwards curves, 25519 and ...
ehanoc's user avatar
  • 153
1 vote
1 answer
170 views

What is the recommended signature message padding for Ed448 in Bouncy Castle?

Bouncy Castle provides 6 different paddings for padding messages. However, I am not quite sure which one to choose from. ISO10126d2, ISO7816d4, PKCS7, TBC, X923, ZeroByte. Given that the native Bouncy ...
Hern's user avatar
  • 125
3 votes
1 answer
584 views

Find Ed25519 Y Coordinate from X Coordinate

Are there any available formulas to determine a $Y$ coordinate given only an $X$ for the Ed25519 curve? The closest thing I've come to find is the recover_x(y, sign)...
J Medeiros's user avatar
4 votes
2 answers
260 views

Ed448 parameters wrong in RFC7748

When implementing and testing my own EdDSA program I found out that the old RFC7748 gives wrong parameters for Ed448/Edwards448. There is currently a new Draft were this is clarified: https://...
Habor's user avatar
  • 43
2 votes
1 answer
74 views

Is this half-smart way of verifying EdDSA signature secure?

In the final step of verifying an EdDSA signature, 4[S]B is compared to [4]R + [4][k]A. Because I'm using the XYTZ - extended ...
DannyNiu's user avatar
  • 9,001
1 vote
0 answers
85 views

Collision-resistant single-pass EdDSA?

Is there any reason why collision resistant variants of ed25519 that use a single-pass aren't used instead? For example: $n = h(noncekey \| m)$ $h(R \| pub \| n)$ instead of $h(R \| pub \| m)$ or ...
augustus's user avatar
3 votes
1 answer
237 views

two closely distanced ECDSA keys

Assume that one uses two private keys $x_1$ and $x_2$ to generate two public ECDSA keys $y_1$ and $y_2$ (e.g., used as public key for Bitcoin address). The distance between $x_1$ and $x_2$ is small (e....
Sean's user avatar
  • 99
0 votes
0 answers
43 views

EC implementation on Edward curves : what modulo is used in implementation?

I'm trying to implement EC scalar multiplication in the fastest way possible (but still with a good curve) on a GPU. I'm specifically looking to implement it based on https://github.com/Chair-for-...
maxbc's user avatar
  • 101
0 votes
0 answers
140 views

Why is the cofactor of the twisted Edwards curve equal to 8?

While The cofactor of the Edwards curve is chosen $4$ in standards, the cofactor of the twisted Edwards curve is chosen $8$. I can't understand the reason for this. Can we choose cofactor $4$ for the ...
Mahdi Mahdavi's user avatar
3 votes
1 answer
696 views

Digital Signatures with Curve25519 key-pair

I have a public/private key pair of Curve25519 keys used by Wireguard. How can I use this keypair to generate/verify digital signatures? Preferrably, I would like to use EdDSA/Ed25519 but I struggle ...
Steffen Vogel's user avatar
2 votes
1 answer
144 views

Why does the EdDSA use a 2b-bit hash function?

The EdDSA signature of a message $M$ under key $k$ is created as: Define $r=H(h_b,....,h_{2b−1},M)\in\{0,1,...,2^{2b}−1\}$. Define $R=rB$. Define $S=(r+H(\underline R,\underline A,M)s)\bmod\ell$. ...
Mahdi Mahdavi's user avatar
1 vote
0 answers
93 views

Why does EDDSA secret scaler pruning not prevent values >= prime L or zero?

I have been exploring and studying the EDDSA algorithm for curve 25519 and curve 448 in RFC 8032 (https://www.rfc-editor.org/rfc/rfc8032) as well as for curves 414 and 521 from this (https://eprint....
cookiecipher's user avatar
3 votes
1 answer
483 views

Public key derivation for Ed448

Another potentially silly question here, but I seem to have developed tunnel vision and I am missing something very basic. In RFC 8032 one can find a number of test vectors for Ed488 - for example: <...
Jay Smith's user avatar
1 vote
1 answer
86 views

EdDSA point encoding difference between documentation and implementation

The RFC 8032 describes the point encoding like this : A curve point (x,y), with coordinates in the range 0 <= x,y < p, is coded as follows. First, encode the y-coordinate as a little-endian ...
cmdEvo's user avatar
  • 47
7 votes
3 answers
370 views

Rationale for verification with cofactor $2^c$ in EdDSA?

EdDSA for more curves describes two options of signature verification Verification, which checks $2^c\,S\,B\,=\,2^c\,R+2^c\,H(\underline R,\underline A,M)\,A$ Cofactorless verification, which checks $...
fgrieu's user avatar
  • 138k
4 votes
2 answers
319 views

Would EdDSA be broken by replacing H(R, A, M) with H(A, M)?

An EdDSA signature is (R, S) where R = r*B and S = r + H(R, A, M)*s. Notation from Wikipedia en.wikipedia.org/wiki/EdDSA. Given that the hash function H, is indeed collision-resistant, would using S = ...
Frans Lundberg's user avatar
3 votes
1 answer
709 views

How is EdDSA different from ECDSA with a custom curve?

I just found this draft/informal IETF specification: Alternative Elliptic Curve Representation: This document specifies how to represent Montgomery curves and (twisted) Edwards curves as curves in ...
DurandA's user avatar
  • 453
0 votes
1 answer
673 views

Can the EdDSA signature scheme be customized with OpenSSL?

EdDSA has currently two signature schemes: Ed25519 and Ed448. Ed25519 is the EdDSA signature scheme using SHA-512 (SHA-2) and Curve25519 Ed448 is the EdDSA signature scheme using SHAKE256 (SHA-3) ...
flowb's user avatar
  • 111
3 votes
1 answer
333 views

Likelihood of signature collision with EdDSA

Taking EdDSA as an example, given the length of a signature is 512-bits for a given data payload, what is the probability of a collision where there is another 512-bit value that is also a valid ...
Woodstock's user avatar
  • 1,374
1 vote
1 answer
400 views

What are the extended homogeneous coordinates in the EdDSA specification?

According to the EdDSA specification from the IETF: For point addition, the following method is recommended. A point (x,y) is represented in extended homogeneous coordinates (X, Y, Z, T), with x = X/...
simbro's user avatar
  • 263
4 votes
0 answers
531 views

Does EdDSA share Schnorr signature secure linearity property?

EdDSA, Edwards-curve Digital Signature Algorithm (EdDSA), is a digital signature scheme using a variant of Schnorr signature based on Twisted Edwards curves (source). Schnorr signatures have a ...
Robert Zaremba's user avatar
2 votes
1 answer
188 views

Generating a small EdDSA curve

I have an application that would benefit from very small (e.g., 16-20 byte) EdDSA keys and small signatures. It's an application where the goal is more to deter DOS attacks than "hard" ...
Adam Ierymenko's user avatar
18 votes
1 answer
16k views

What is the difference between ECDSA and EdDSA?

As I understand it, both work with elliptic curves, but there seems to be a difference as EdDSA is generally recommended over ECDSA.
Tartori's user avatar
  • 283
38 votes
1 answer
16k views

ECDSA, EdDSA and ed25519 relationship / compatibility

I'm trying to understand the relationship between those three signature schemes (ECDSA, EdDSA, and ed25519) and mainly to what degree they are mutually compatible in the sense of key-pair derivation, ...
Rafael Korbas's user avatar
6 votes
1 answer
463 views

Is there any reason not to use EdDSA with Weierstrass curves?

I'm volunterely working for a crypto library and we're planning on adding Curve25519 support (finally). At the same point I had the idea of adding support for EdDSA in the same run. Our library is ...
SEJPM's user avatar
  • 45.7k
6 votes
1 answer
808 views

EdDSA Signature Algorithm - hash of secret key

Why does EdDSA use the (SHA-512) hash of the secret key as the exponent for the public key rather than using the secret key value directly? This seems inefficient, and I can't see how it adds any ...
geoff_h's user avatar
  • 347
1 vote
1 answer
411 views

Is this EdDSA modification secure?

I am hoping to employ a signed set membership system which is valid iff each signer's contribution to the set is present. The system should allow for two or more mutually exclusive signed sets to be ...
Thomas Ryan Stovall's user avatar