# Questions tagged [eddsa]

In public-key cryptography, Edwards-curve Digital Signature Algorithm (EdDSA) is a digital signature scheme using a variant of Schnorr signature based on twisted Edwards curves. It is designed to be faster than existing digital signature schemes without sacrificing security. It was developed by a team including Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, and Bo-Yin Yang. The reference implementation is public domain software.

16 questions
Filter by
Sorted by
Tagged with
31 views

### Why does EDDSA secret scaler pruning not prevent values >= prime L or zero?

I have been exploring and studying the EDDSA algorithm for curve 25519 and curve 448 in RFC 8032 (https://tools.ietf.org/html/rfc8032) as well as for curves 414 and 521 from this (https://eprint.iacr....
44 views

### Public key derivation for Ed448

Another potentially silly question here, but I seem to have developed tunnel vision and I am missing something very basic. In RFC 8032 one can find a number of test vectors for Ed488 - for example: <...
36 views

### EdDSA point encoding difference between documentation and implementation

The RFC 8032 describes the point encoding like this : A curve point (x,y), with coordinates in the range 0 <= x,y < p, is coded as follows. First, encode the y-coordinate as a little-endian ...
182 views

### Rationale for verification with cofactor $2^c$ in EdDSA?

In EdDSA for more curves, it's described two options of signature verification Verification, which checks $2^c\,S\,B\,=\,2^c\,R+2^c\,H(\underline R,\underline A,M)\,A$ Cofactorless verification, ...
237 views

### Would EdDSA be broken by replacing H(R, A, M) with H(A, M)?

An EdDSA signature is (R, S) where R = r*B and S = r + H(R, A, M)*s. Notation from Wikipedia en.wikipedia.org/wiki/EdDSA. Given that the hash function H, is indeed collision-resistant, would using S = ...
135 views

### How is EdDSA different from ECDSA with a custom curve?

I just found this draft/informal IETF specification: Alternative Elliptic Curve Representation: This document specifies how to represent Montgomery curves and (twisted) Edwards curves as curves in ...
198 views

### Can the EdDSA signature scheme be customized with OpenSSL?

EdDSA has currently two signature schemes: Ed25519 and Ed448. Ed25519 is the EdDSA signature scheme using SHA-512 (SHA-2) and Curve25519 Ed448 is the EdDSA signature scheme using SHAKE256 (SHA-3) ...
178 views

### Likelihood of signature collision with EdDSA

Taking EdDSA as an example, given the length of a signature is 512-bits for a given data payload, what is the probability of a collision where there is another 512-bit value that is also a valid ...
73 views

### What are the extended homogeneous coordinates in the EdDSA specification?

According to the EdDSA specification from the IETF: For point addition, the following method is recommended. A point (x,y) is represented in extended homogeneous coordinates (X, Y, Z, T), with x = X/...
137 views

### Does EdDSA share Schnorr signature secure linearity property?

EdDSA, Edwards-curve Digital Signature Algorithm (EdDSA), is a digital signature scheme using a variant of Schnorr signature based on Twisted Edwards curves (source). Schnorr signatures have a ...
138 views

### Generating a small EdDSA curve

I have an application that would benefit from very small (e.g., 16-20 byte) EdDSA keys and small signatures. It's an application where the goal is more to deter DOS attacks than "hard" ...
6k views

### What is the difference between ECDSA and EdDSA?

As I understand it, both work with elliptic curves, but there seems to be a difference as EdDSA is generally recommended over ECDSA.
12k views

### ECDSA, EdDSA and ed25519 relationship / compatibility

I'm trying to understand the relationship between those three signature schemes (ECDSA, EdDSA, and ed25519) and mainly to what degree they are mutually compatible in the sense of key-pair derivation, ...
366 views

### Is there any reason not to use EdDSA with Weierstrass curves?

I'm volunterely working for a crypto library and we're planning on adding Curve25519 support (finally). At the same point I had the idea of adding support for EdDSA in the same run. Our library is ...