Skip to main content
2 of 2
replaced https://tools.ietf.org/html/rfc with https://www.rfc-editor.org/rfc/rfc

A bit of nomenclature first: “Ed25519” is defined to refer to the EdDSA signature algorithm over the edwards25519 curve. What you appear to actually mean is whether you can reuse your edwards25519 code for Elliptic Curve Diffie–Hellman (ECDH).

There is no inherent reason that you can't use edwards25519 for ECDH. We've been doing ECDH with all kinds of curves for ages already, and edwards25519 works just fine as any other. You need to take the same precautions as for X25519, too: multiply by the cofactor $h=8$ or check against a blacklist of bad points (but the encoding of those points will differ between compressed edwards25519 points as for Ed25519 and X25519).

Since you say you're looking at a constrained-memory system, it is likely that you've first built signature verification (which not require constant-time code). If you're going to reuse this code for key exchanges, make sure all curve code and field arithmetic code (except the routines only used signature verification) are made to be constant-time.

A key exchange protocol requires more than just a curve, however, so you may want to look into e. g. the Noise protocol patterns.

xorhash
  • 233
  • 1
  • 7
  • 25