Questions tagged [eddsa]
In public-key cryptography, Edwards-curve Digital Signature Algorithm (EdDSA) is a digital signature scheme using a variant of Schnorr signature based on twisted Edwards curves. It is designed to be faster than existing digital signature schemes without sacrificing security. It was developed by a team including Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, and Bo-Yin Yang. The reference implementation is public domain software.
29
questions
2
votes
1
answer
79
views
What would be the security consequences of replacing $H(R, A, M)$ with $H(R, M)$ in EdDSA?
The question is mainly stated in the title. We don't consider any other changes to the scheme except for the following:
We replace $S = H(R,A,M) \cdot a + r$ with $S = H(R,M) \cdot a + r$.
My thoughts ...
- 878
0
votes
1
answer
58
views
Reason for two random numbers in DSA?
Why is the signature in DSA the way it is?
I am referring to $r$ and $k$ in the Signing-Algorithm depicted below. Is it really necessary to have both, $r$ and $s$, or would it still be secure if only ...
- 21
5
votes
1
answer
270
views
RFCs & IANA specs about Ed25519 inaccurate?
While designing a crypto system based on existing standards and specifications i find myself questioning some of the accuracy in the current RFC-8037 and IANA specs around Edwards curves, 25519 and ...
- 153
1
vote
1
answer
170
views
What is the recommended signature message padding for Ed448 in Bouncy Castle?
Bouncy Castle provides 6 different paddings for padding messages.
However, I am not quite sure which one to choose from.
ISO10126d2, ISO7816d4, PKCS7, TBC, X923, ZeroByte.
Given that the native Bouncy ...
- 125
3
votes
1
answer
584
views
Find Ed25519 Y Coordinate from X Coordinate
Are there any available formulas to determine a $Y$ coordinate given only an $X$ for the Ed25519 curve? The closest thing I've come to find is the recover_x(y, sign)...
- 67
4
votes
2
answers
260
views
Ed448 parameters wrong in RFC7748
When implementing and testing my own EdDSA program I found out that the old RFC7748 gives wrong parameters for Ed448/Edwards448.
There is currently a new Draft were this is clarified:
https://...
- 43
2
votes
1
answer
74
views
Is this half-smart way of verifying EdDSA signature secure?
In the final step of verifying an EdDSA signature, 4[S]B is compared to [4]R + [4][k]A.
Because I'm using the XYTZ - extended ...
- 9,001
1
vote
0
answers
85
views
Collision-resistant single-pass EdDSA?
Is there any reason why collision resistant variants of ed25519 that use a single-pass aren't used instead? For example:
$n = h(noncekey \| m)$
$h(R \| pub \| n)$ instead of $h(R \| pub \| m)$
or ...
- 77
3
votes
1
answer
237
views
two closely distanced ECDSA keys
Assume that one uses two private keys $x_1$ and $x_2$ to generate two public ECDSA keys $y_1$ and $y_2$ (e.g., used as public key for Bitcoin address). The distance between $x_1$ and $x_2$ is small (e....
- 99
0
votes
0
answers
43
views
EC implementation on Edward curves : what modulo is used in implementation?
I'm trying to implement EC scalar multiplication in the fastest way possible (but still with a good curve) on a GPU.
I'm specifically looking to implement it based on https://github.com/Chair-for-...
- 101
0
votes
0
answers
140
views
Why is the cofactor of the twisted Edwards curve equal to 8?
While The cofactor of the Edwards curve is chosen $4$ in standards, the cofactor of the twisted Edwards curve is chosen $8$. I can't understand the reason for this. Can we choose cofactor $4$ for the ...
- 482
3
votes
1
answer
696
views
Digital Signatures with Curve25519 key-pair
I have a public/private key pair of Curve25519 keys used by Wireguard.
How can I use this keypair to generate/verify digital signatures?
Preferrably, I would like to use EdDSA/Ed25519 but I struggle ...
2
votes
1
answer
144
views
Why does the EdDSA use a 2b-bit hash function?
The EdDSA signature of a message $M$ under key $k$ is created as:
Define $r=H(h_b,....,h_{2b−1},M)\in\{0,1,...,2^{2b}−1\}$.
Define $R=rB$.
Define $S=(r+H(\underline R,\underline A,M)s)\bmod\ell$.
...
- 482
1
vote
0
answers
93
views
Why does EDDSA secret scaler pruning not prevent values >= prime L or zero?
I have been exploring and studying the EDDSA algorithm for curve 25519 and curve 448 in RFC 8032 (https://www.rfc-editor.org/rfc/rfc8032) as well as for curves 414 and 521 from this (https://eprint....
- 307
3
votes
1
answer
483
views
Public key derivation for Ed448
Another potentially silly question here, but I seem to have developed tunnel vision and I am missing something very basic.
In RFC 8032 one can find a number of test vectors for Ed488 - for example:
<...
- 71
1
vote
1
answer
86
views
EdDSA point encoding difference between documentation and implementation
The RFC 8032 describes the point encoding like this :
A curve point (x,y), with coordinates in the range 0 <= x,y < p, is
coded as follows. First, encode the y-coordinate as a little-endian
...
- 47
7
votes
3
answers
370
views
Rationale for verification with cofactor $2^c$ in EdDSA?
EdDSA for more curves describes two options of signature verification
Verification, which checks $2^c\,S\,B\,=\,2^c\,R+2^c\,H(\underline R,\underline A,M)\,A$
Cofactorless verification, which checks $...
- 138k
4
votes
2
answers
319
views
Would EdDSA be broken by replacing H(R, A, M) with H(A, M)?
An EdDSA signature is (R, S) where R = r*B and S = r + H(R, A, M)*s. Notation from Wikipedia en.wikipedia.org/wiki/EdDSA.
Given that the hash function H, is indeed collision-resistant, would using S = ...
- 375
3
votes
1
answer
709
views
How is EdDSA different from ECDSA with a custom curve?
I just found this draft/informal IETF specification: Alternative Elliptic Curve Representation:
This document specifies how to represent Montgomery curves and (twisted) Edwards curves as curves in ...
- 453
0
votes
1
answer
673
views
Can the EdDSA signature scheme be customized with OpenSSL?
EdDSA has currently two signature schemes: Ed25519 and Ed448.
Ed25519 is the EdDSA signature scheme using SHA-512 (SHA-2) and Curve25519
Ed448 is the EdDSA signature scheme using SHAKE256 (SHA-3) ...
- 111
3
votes
1
answer
333
views
Likelihood of signature collision with EdDSA
Taking EdDSA as an example, given the length of a signature is 512-bits for a given data payload,
what is the probability of a collision where there is another 512-bit value that is also a valid ...
- 1,374
1
vote
1
answer
400
views
What are the extended homogeneous coordinates in the EdDSA specification?
According to the EdDSA specification from the IETF:
For point addition, the following method is recommended. A point (x,y) is represented in extended homogeneous coordinates (X, Y, Z, T), with x = X/...
- 263
4
votes
0
answers
531
views
Does EdDSA share Schnorr signature secure linearity property?
EdDSA, Edwards-curve Digital Signature Algorithm (EdDSA), is a digital signature scheme using a variant of Schnorr signature based on Twisted Edwards curves (source).
Schnorr signatures have a ...
- 263
2
votes
1
answer
188
views
Generating a small EdDSA curve
I have an application that would benefit from very small (e.g., 16-20 byte) EdDSA keys and small signatures. It's an application where the goal is more to deter DOS attacks than "hard" ...
- 896
18
votes
1
answer
16k
views
What is the difference between ECDSA and EdDSA?
As I understand it, both work with elliptic curves, but there seems to be a difference as EdDSA is generally recommended over ECDSA.
- 283
38
votes
1
answer
16k
views
ECDSA, EdDSA and ed25519 relationship / compatibility
I'm trying to understand the relationship between those three signature schemes (ECDSA, EdDSA, and ed25519) and mainly to what degree they are mutually compatible in the sense of key-pair derivation, ...
- 483
6
votes
1
answer
463
views
Is there any reason not to use EdDSA with Weierstrass curves?
I'm volunterely working for a crypto library and we're planning on adding Curve25519 support (finally). At the same point I had the idea of adding support for EdDSA in the same run.
Our library is ...
- 45.7k
6
votes
1
answer
808
views
EdDSA Signature Algorithm - hash of secret key
Why does EdDSA use the (SHA-512) hash of the secret key as the exponent for the public key rather than using the secret key value directly? This seems inefficient, and I can't see how it adds any ...
- 347
1
vote
1
answer
411
views
Is this EdDSA modification secure?
I am hoping to employ a signed set membership system which is valid iff each signer's contribution to the set is present. The system should allow for two or more mutually exclusive signed sets to be ...
