# Tag Info

### Why Curve25519 for encryption but Ed25519 for signatures?

While it is true that Elliptic Curve Diffie Hellman (ECDH), Elliptic Curve Signature Generation (ECDSA), and Elliptic Curve Signature Verification rely on scalar multiplications, these are usually ...
• 7,144
Accepted

### Elliptic curve ed25519 vs ed448 - Differences

Edwards25519 is the twisted Edwards curve $$-x^2 + y^2 = 1 - (121665/121666) x^2 y^2$$ over the prime field $\mathbb F_p$ where $p = 2^{255} - 19$. The coefficient $d = -121665/121666$ was chosen to ...
• 49.1k
Accepted

### Is it bad to expose the public key?

From a cryptographic standpoint it is OK to expose a public key in the sense of revealing its value. The most basic assumption in cryptography involving public/private key pairs is that the value of a ...
• 144k
Accepted

### ECDSA, EdDSA and ed25519 relationship / compatibility

Ed25519 is a specific instance of the EdDSA family of signature schemes. Ed25519 is specified in RFC 8032 and widely used. The only other instance of EdDSA that anyone cares about is Ed448, which is ...
• 49.1k

### Why Curve25519 for encryption but Ed25519 for signatures?

The old terminology was confusing, so they've rebranded a bit. X25519 is Elliptic Curve Diffie-Hellman (ECDH) over Curve25519 Ed25519 is Edwards-curve Digital Signature Algorithm (EdDSA) over ...
Accepted

• 341
Accepted

### "Cropping" the resulting shared secret from ECDH

You should apply the hash. If one follows the specification there are only roughly $2^{251}$ possible shared secret values and there is a simple test to see if a putative 32 bytes represents a ...
• 25.4k
Accepted

### ed25519 ssh public key is always 80 characters long?

Is there an option/param like when creating RSA keys that may influence the length of the key, or by design will always be 80 (68 removing the ssh-ed25519) characters? No, there can't be any such ...
• 46.3k

### Converting a C25519 curve into a NIST-supported curve for FIPS crypto

No, conversion of an EC key pair from a curve to another of unrelated order is not possible. One of the closest things that could be done would be that parties generate a new P256 key pair, then ...
• 144k

### Why are NaCl secret keys 64 bytes for signing, but 32 bytes for box?

Opening and sealing a box involves your private scalar and the other party's public key. So the private key is simply the private scalar. Signing with Ed25519 involves your private scalar and your ...
• 25k