Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs
44 votes
Accepted

ECDSA, EdDSA and ed25519 relationship / compatibility

Ed25519 is a specific instance of the EdDSA family of signature schemes. Ed25519 is specified in RFC 8032 and widely used. The only other instance of EdDSA that anyone cares about is Ed448, which is ...
Squeamish Ossifrage's user avatar
34 votes
Accepted

Curve25519 over Ed25519 for key exchange? Why?

There's a few different related parts here, and the nomenclature of the library you've cited is a little confusing. Curve25519 is an elliptic curve over the finite field $\mathbb F_p$, where $p = 2^{...
Squeamish Ossifrage's user avatar
34 votes

Digital signature that is only verifiable by one specific person

What you seem to be looking for is deniable authentication. This is actually a somewhat stronger property than what you're asking for: it guarantees that the recipient (let's call him Bob) cannot ...
Ilmari Karonen's user avatar
27 votes
Accepted

What is the difference between ECDSA and EdDSA?

Partially covered by does TLS 1.3 use ECDSA-Sig-Value encoded signatures for Ed25519 / Ed448? but to add a little, rfc8032 describes EdDSA's advantages as: EdDSA provides high performance on a ...
dave_thompson_085's user avatar
26 votes

ECDSA Signature R|S to ASN1 DER Encoding question

The ASN.1 DER format is deterministic; i.e. there is only a single sequence of bytes that validly encodes given $r$ and $s$ values. Mind the details, though: the encodings of $r$ and $s$ are minimal-...
Thomas Pornin's user avatar
26 votes
Accepted

Difference between X25519 vs. Ed25519

Is X25519 and Ed25519 the same curve? No. X25519 isn't a curve, it's an Elliptic-Curve Diffie-Hellman (ECDH) protocol using the x coordinate of the curve Curve25519. Ed25519 is an Edwards Digital ...
SAI Peregrinus's user avatar
24 votes
Accepted

What is the intuition for ECDSA?

It is possible to view DSA/ECDSA as an identification scheme (like Schnorr) but with a different variant of Fiat-Shamir. This gives the intuition that you are perhaps looking for. I will include an ...
Yehuda Lindell's user avatar
17 votes

Can deterministic ECDSA be protected against fault attacks?

As already said by fgrieu in his answer, this is possible. There are multiple ways to protect deterministic ECDSA against fault attacks, but these ways will depend on your fault model. If you consider ...
Lery's user avatar
  • 7,699
17 votes
Accepted

Why ECDSA has its form?

The main reason is historical (and a bit sad). ECDSA can be seen as a repurposed authentication mechanism. The private key owner wants to prove knowledge of the private key $x$ that matches a given ...
Thomas Pornin's user avatar
14 votes

Digital signature that is only verifiable by one specific person

Lets say Alice wants to send Bob a sensitive message, she wants to prove to Bob that it came from her, but she doesn't want Bob to be able to prove that to anyone else. A MAC is a good way of doing ...
JvH's user avatar
  • 162
13 votes
Accepted

When would I need DSA as opposed to RSA for digital signature?

The digital signature algorithm encrypts a hash using the senders private key and the receiver's public key. Huh? I see two problems with the above statement; "Encryption"; using the word ...
poncho's user avatar
  • 148k
13 votes
Accepted

Are ECDSA keys and RSA keys interchangeable?

From the source code: ...
Thomas Pornin's user avatar
13 votes
Accepted

Are DSA and ECDSA provably secure assuming DL security?

(The (EC)DSA algorithm involves two functions: (i) the "conversion function" $f$, which for the case of DSA is a modulo $q$ operation and for ECDSA is the modulo $q$ operation applied to the $x$-...
ckamath's user avatar
  • 5,248
12 votes
Accepted

Reasons for Chinese SM2 Digital Signature Algorithm

The SM2 digital signature algorithm. Fix a curve $E/k$ over a field $\mathbb F_p$. Fix a standard base point $G$ of prime order $n$ on $E/\mathbb F_p$. Fix a hash function $H\colon \{0,1\}^* \to \...
Squeamish Ossifrage's user avatar
12 votes

Which hash is used when providing signature algorithm ED25519 or ED448?

Hash algorithms: Ed25519 uses SHA-512 (As referenced on wikipedia or on bearssl.org) Ed448 uses SHAKE-256$^1$ (As referenced on bearssl.org) $^1$ SHAKE-256 is a SHA-3 algorithm, a subgroup of the "...
AleksanderCH's user avatar
  • 6,463
12 votes
Accepted

Understanding example of ECDSA P256

ECDSA is specified in SEC1. It's instantiation with curve P-256 is specified in FIPS 186-4 (or equivalently in SEC2 under the name secp256r1), and tells that ...
fgrieu's user avatar
  • 142k
11 votes
Accepted

How can a non-crypto-expert implement crypto libraries in a programming language?

The best option is to avoid doing so as much as possible. Ideally, your language of choice will offer a wrapper around a battle tested library such as libsodium (or maybe bearssl one day). ...
Ella Rose's user avatar
  • 19.6k
11 votes
Accepted

What is the recommended minimum key length for ECDSA signature

You are already well on your way if you've found https://keylength.com. It references the documents that the recommendations are based on, so if you need a more clear reason to go for a specific key ...
Maarten Bodewes's user avatar
11 votes

Why OpenSSH prefers ECDSA nistp256 keys over -384 and -521, and those over Ed25519, for host key verification?

If I remember correctly, it is simply an issue of performance. Remember, HostKeyAlgorithms determines the method used to authenticate the server to the client, it ...
Richie Frame's user avatar
  • 13.1k
10 votes

ECDSA key recovery - floating point values

This is not correct, the private key $d_A$ must always be an integer. Your mistake is that you are doing modular division e.g. $\frac{a}{b} \text{ mod } n$ incorrectly. You cannot simply divide the ...
puzzlepalace's user avatar
  • 4,042
10 votes
Accepted

Elliptic Curve Cryptography - When to use p and when to use n

A possible analogy is two layers in a communication protocol, with $p$ and $n$ the maximum packet payload for the lower and upper layer. They need not be equal (in communication protocols, typically ...
fgrieu's user avatar
  • 142k
10 votes

Can deterministic ECDSA be protected against fault attacks?

Yes, ECDSA (including deterministic) can be protected against fault attacks. An idea is to check any computed signature (by the verifier's algorithm) before releasing the signature (and not releasing ...
fgrieu's user avatar
  • 142k
10 votes
Accepted

Which hash is used when providing signature algorithm ED25519 or ED448?

If you follow the references in RFC 8446, you'll see that it cites RFC 8032 for the definition of the EdDSA-based algorithms. RFC 8032 in turn tells you all the details about the hash functions and ...
Squeamish Ossifrage's user avatar
10 votes

Why OpenSSH prefers ECDSA nistp256 keys over -384 and -521, and those over Ed25519, for host key verification?

So I got curious as to how fast things actually are. Apparently you can use $ openssl speed to see how fast certain operations are. I am not sure, however, as to ...
squirrel's user avatar
  • 331
9 votes

What is the relation between x y and r s in an ECDSA signature?

Yes, those encoded values are $r$ and $s$. The ASN.1 integers are signed big endian values while the two fixed sized values are unsigned big endian. So the value field may be identical or it may not, ...
Maarten Bodewes's user avatar
9 votes
Accepted

EdDSA (Ed25519) is any random number sufficient for a good private key?

Yes. In order to understand why, you need to understand how the public key is computed. The secret key is a scalar. A fixed base point is multiplied by that scalar, and no matter what that scalar ...
Frank Denis's user avatar
  • 2,973
9 votes
Accepted

Is there a truly safe signing algorithm?

The signing algorithms most often used nowadays are: RSA based signature algorithms such as RSA-PKCS#1 v1.5 and the more recent RSA-PSS (currently specified in PKCS#1v2.2) ECDSA, which is the "...
Lery's user avatar
  • 7,699
9 votes

Why can we not use the group $Z_{p}^{*}$ for cryptography?

You can use the multiplicative group $\mathbb{Z}_p^*$, provided you use a key long enough to be secure. Diffie-Hellman key exchange, DSA and the ElGamal cryptosystem were originally defined based on ...
jadb's user avatar
  • 437
9 votes
Accepted

What is TPMFail attack and what are the countermeasures?

In short, TPMFail attack is black-box timing analysis of TPM 2.0 devices deployed on computers. The TPMfail team is able to extract the private authentication key of TPMS's 256-bit private keys for ...
kelalaka's user avatar
  • 48.7k

Only top scored, non community-wiki answers of a minimum length are eligible