Questions tagged [eddsa]

In public-key cryptography, Edwards-curve Digital Signature Algorithm (EdDSA) is a digital signature scheme using a variant of Schnorr signature based on twisted Edwards curves. It is designed to be faster than existing digital signature schemes without sacrificing security. It was developed by a team including Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, and Bo-Yin Yang. The reference implementation is public domain software.

Filter by
Sorted by
Tagged with
1 vote
1 answer
81 views

What is the recommended signature message padding for Ed448 in Bouncy Castle?

Bouncy Castle provides 6 different paddings for padding messages. However, I am not quite sure which one to choose from. ISO10126d2, ISO7816d4, PKCS7, TBC, X923, ZeroByte. Given that the native Bouncy ...
  • 115
3 votes
1 answer
382 views

Find Ed25519 Y Coordinate from X Coordinate

Are there any available formulas to determine a $Y$ coordinate given only an $X$ for the Ed25519 curve? The closest thing I've come to find is the recover_x(y, sign)...
4 votes
2 answers
187 views

Ed448 parameters wrong in RFC7748

When implementing and testing my own EdDSA program I found out that the old RFC7748 gives wrong parameters for Ed448/Edwards448. There is currently a new Draft were this is clarified: https://...
  • 43
2 votes
1 answer
69 views

Is this half-smart way of verifying EdDSA signature secure?

In the final step of verifying an EdDSA signature, 4[S]B is compared to [4]R + [4][k]A. Because I'm using the XYTZ - extended ...
  • 8,015
1 vote
0 answers
80 views

Collision-resistant single-pass EdDSA?

Is there any reason why collision resistant variants of ed25519 that use a single-pass aren't used instead? For example: $n = h(noncekey \| m)$ $h(R \| pub \| n)$ instead of $h(R \| pub \| m)$ or ...
3 votes
1 answer
159 views

two closely distanced ECDSA keys

Assume that one uses two private keys $x_1$ and $x_2$ to generate two public ECDSA keys $y_1$ and $y_2$ (e.g., used as public key for Bitcoin address). The distance between $x_1$ and $x_2$ is small (e....
  • 57
0 votes
0 answers
32 views

EC implementation on Edward curves : what modulo is used in implementation?

I'm trying to implement EC scalar multiplication in the fastest way possible (but still with a good curve) on a GPU. I'm specifically looking to implement it based on https://github.com/Chair-for-...
  • 101
0 votes
0 answers
110 views

Why is the cofactor of the twisted Edwards curve equal to 8?

While The cofactor of the Edwards curve is chosen $4$ in standards, the cofactor of the twisted Edwards curve is chosen $8$. I can't understand the reason for this. Can we choose cofactor $4$ for the ...
3 votes
1 answer
504 views

Digital Signatures with Curve25519 key-pair

I have a public/private key pair of Curve25519 keys used by Wireguard. How can I use this keypair to generate/verify digital signatures? Preferrably, I would like to use EdDSA/Ed25519 but I struggle ...
2 votes
1 answer
129 views

Why does the EdDSA use a 2b-bit hash function?

The EdDSA signature of a message $M$ under key $k$ is created as: Define $r=H(h_b,....,h_{2b−1},M)\in\{0,1,...,2^{2b}−1\}$. Define $R=rB$. Define $S=(r+H(\underline R,\underline A,M)s)\bmod\ell$. ...
1 vote
0 answers
80 views

Why does EDDSA secret scaler pruning not prevent values >= prime L or zero?

I have been exploring and studying the EDDSA algorithm for curve 25519 and curve 448 in RFC 8032 (https://www.rfc-editor.org/rfc/rfc8032) as well as for curves 414 and 521 from this (https://eprint....
3 votes
1 answer
361 views

Public key derivation for Ed448

Another potentially silly question here, but I seem to have developed tunnel vision and I am missing something very basic. In RFC 8032 one can find a number of test vectors for Ed488 - for example: <...
  • 71
1 vote
1 answer
71 views

EdDSA point encoding difference between documentation and implementation

The RFC 8032 describes the point encoding like this : A curve point (x,y), with coordinates in the range 0 <= x,y < p, is coded as follows. First, encode the y-coordinate as a little-endian ...
  • 47
6 votes
3 answers
322 views

Rationale for verification with cofactor $2^c$ in EdDSA?

EdDSA for more curves describes two options of signature verification Verification, which checks $2^c\,S\,B\,=\,2^c\,R+2^c\,H(\underline R,\underline A,M)\,A$ Cofactorless verification, which checks $...
  • 132k
3 votes
2 answers
293 views

Would EdDSA be broken by replacing H(R, A, M) with H(A, M)?

An EdDSA signature is (R, S) where R = r*B and S = r + H(R, A, M)*s. Notation from Wikipedia en.wikipedia.org/wiki/EdDSA. Given that the hash function H, is indeed collision-resistant, would using S = ...
3 votes
1 answer
572 views

How is EdDSA different from ECDSA with a custom curve?

I just found this draft/informal IETF specification: Alternative Elliptic Curve Representation: This document specifies how to represent Montgomery curves and (twisted) Edwards curves as curves in ...
  • 433
0 votes
1 answer
584 views

Can the EdDSA signature scheme be customized with OpenSSL?

EdDSA has currently two signature schemes: Ed25519 and Ed448. Ed25519 is the EdDSA signature scheme using SHA-512 (SHA-2) and Curve25519 Ed448 is the EdDSA signature scheme using SHAKE256 (SHA-3) ...
  • 111
3 votes
1 answer
312 views

Likelihood of signature collision with EdDSA

Taking EdDSA as an example, given the length of a signature is 512-bits for a given data payload, what is the probability of a collision where there is another 512-bit value that is also a valid ...
  • 1,324
1 vote
1 answer
305 views

What are the extended homogeneous coordinates in the EdDSA specification?

According to the EdDSA specification from the IETF: For point addition, the following method is recommended. A point (x,y) is represented in extended homogeneous coordinates (X, Y, Z, T), with x = X/...
  • 233
3 votes
0 answers
391 views

Does EdDSA share Schnorr signature secure linearity property?

EdDSA, Edwards-curve Digital Signature Algorithm (EdDSA), is a digital signature scheme using a variant of Schnorr signature based on Twisted Edwards curves (source). Schnorr signatures have a ...
2 votes
1 answer
179 views

Generating a small EdDSA curve

I have an application that would benefit from very small (e.g., 16-20 byte) EdDSA keys and small signatures. It's an application where the goal is more to deter DOS attacks than "hard" ...
16 votes
1 answer
14k views

What is the difference between ECDSA and EdDSA?

As I understand it, both work with elliptic curves, but there seems to be a difference as EdDSA is generally recommended over ECDSA.
  • 263
36 votes
1 answer
15k views

ECDSA, EdDSA and ed25519 relationship / compatibility

I'm trying to understand the relationship between those three signature schemes (ECDSA, EdDSA, and ed25519) and mainly to what degree they are mutually compatible in the sense of key-pair derivation, ...
6 votes
1 answer
437 views

Is there any reason not to use EdDSA with Weierstrass curves?

I'm volunterely working for a crypto library and we're planning on adding Curve25519 support (finally). At the same point I had the idea of adding support for EdDSA in the same run. Our library is ...
  • 45.3k
5 votes
1 answer
766 views

EdDSA Signature Algorithm - hash of secret key

Why does EdDSA use the (SHA-512) hash of the secret key as the exponent for the public key rather than using the secret key value directly? This seems inefficient, and I can't see how it adds any ...
  • 337
1 vote
1 answer
405 views

Is this EdDSA modification secure?

I am hoping to employ a signed set membership system which is valid iff each signer's contribution to the set is present. The system should allow for two or more mutually exclusive signed sets to be ...