Skip to main content
1 of 2
Yehuda Lindell
  • 28.2k
  • 1
  • 68
  • 86

In general, using the same key in different algorithms is bad practice. However, in this specific case, I believe that one could prove security (but I won't do all the details). Before I sketch why, you should ask yourself why you want to do this...

Anyway, since EdDSA is actually a Schnorr signature, this means that it is a zero-knowledge proof of knowledge of the secret key, secure in the random oracle model. Thus, one could proof that if you can break ECDSA given ECDSA and EdDSA signing oracles, then you could break ECDSA given only an ECDSA signing oracle (by simulating the EdDSA signing oracle yourself in the random oracle model). Thus, if ECDSA is secure then using the same key for Schnorr doesn't harm anything.

Yehuda Lindell
  • 28.2k
  • 1
  • 68
  • 86