Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs
61 votes

Why Curve25519 for encryption but Ed25519 for signatures?

While it is true that Elliptic Curve Diffie Hellman (ECDH), Elliptic Curve Signature Generation (ECDSA), and Elliptic Curve Signature Verification rely on scalar multiplications, these are usually ...
Ruggero's user avatar
  • 7,104
53 votes
Accepted

Is it bad to expose the public key?

From a cryptographic standpoint it is OK to expose a public key in the sense of revealing its value. The most basic assumption in cryptography involving public/private key pairs is that the value of a ...
fgrieu's user avatar
  • 142k
52 votes
Accepted

Elliptic curve ed25519 vs ed448 - Differences

Edwards25519 is the twisted Edwards curve $$-x^2 + y^2 = 1 - (121665/121666) x^2 y^2$$ over the prime field $\mathbb F_p$ where $p = 2^{255} - 19$. The coefficient $d = -121665/121666$ was chosen to ...
Squeamish Ossifrage's user avatar
44 votes
Accepted

ECDSA, EdDSA and ed25519 relationship / compatibility

Ed25519 is a specific instance of the EdDSA family of signature schemes. Ed25519 is specified in RFC 8032 and widely used. The only other instance of EdDSA that anyone cares about is Ed448, which is ...
Squeamish Ossifrage's user avatar
37 votes

Why Curve25519 for encryption but Ed25519 for signatures?

The old terminology was confusing, so they've rebranded a bit. X25519 is Elliptic Curve Diffie-Hellman (ECDH) over Curve25519 Ed25519 is Edwards-curve Digital Signature Algorithm (EdDSA) over ...
Scott Arciszewski's user avatar
34 votes
Accepted

Curve25519 over Ed25519 for key exchange? Why?

There's a few different related parts here, and the nomenclature of the library you've cited is a little confusing. Curve25519 is an elliptic curve over the finite field $\mathbb F_p$, where $p = 2^{...
Squeamish Ossifrage's user avatar
26 votes
Accepted

Difference between X25519 vs. Ed25519

Is X25519 and Ed25519 the same curve? No. X25519 isn't a curve, it's an Elliptic-Curve Diffie-Hellman (ECDH) protocol using the x coordinate of the curve Curve25519. Ed25519 is an Edwards Digital ...
SAI Peregrinus's user avatar
23 votes
Accepted

How many qubits are required to break RSA 2048 or 4096 with a universal quantum computer?

How many qubits are required for breaking RSA 2048 and RSA 4096 in real-time with a quantum computer? Like the answer you linked to shows, about $\log_2(N^2) = 2 \log_2(N)$ or just $2n$ where $n$ ...
otus's user avatar
  • 32.1k
18 votes
Accepted

Why are ed25519 keys not recommended for encryption?

You seem confused about a few things. Bear with me, this is a very common confusion! Encryption is defined with the intent of confidentially transporting information: if you encrypt information, it ...
Ruben De Smet's user avatar
15 votes
Accepted

Ed25519 cryptanalysis and backdoor?

if Ed25519 has gone through rigorous cryptanalysis It is based on Curve25519 which has gone through extensive cryptanalysis. The Ed25519 signature scheme as well is being heavily reviewed and ...
forest's user avatar
  • 15.3k
14 votes

Is it bad to expose the public key?

The advent of quantum computing, real usable out of the lab QC, will pretty much be the end of any encryption that relies on the difficulty of the discrete log problem via Shor's Algorithm et al. That ...
Anthony Bachler's user avatar
13 votes
Accepted

How to obtain 256-bit security from Ed25519?

It is not possible to double security level of Ed25519 any trivial way. Instead, doubling security level requires using another curve that is approximately 512 bit curve. In systems compliant with RFC ...
user4982's user avatar
  • 5,329
13 votes
Accepted

Why Ed25519 encodes y-coordinates rather than x-coordinates

This was a concern for patent reasons. As fgrieu mentions, you can recover one coordinate from the other on Edwards curves, so it doesn't matter which you encode. However, as this answer mentions, ...
bk2204's user avatar
  • 3,466
12 votes

Can I use signature(hash(message)) instead of signature(message)?

Yes, this should be secure. I am not familiar with TweetNaCl, so I cannot speak on the concrete implementation. However, the general construction of signing a hash of a message instead of the ...
Guut Boy's user avatar
  • 2,877
12 votes
Accepted

Curve 25519 (X25519, Ed25519) Convert coordinates between Montgomery curve and twisted Edwards curve

The formulas actually work. You just have to keep in mind to make computation in the field of intergers modulo $2^{255}-19$ and that there are actually two square roots, you need to use the right one ...
Ruggero's user avatar
  • 7,104
11 votes
Accepted

Is it possible to derive a public key from another public key without knowing a private key (Ed25519)?

Yes! You can use the ephemeral key derivation mechanism that is for example used in Monero (they call it stealth keys there). Consider public key $A=aG$, with private key $a$. Then, a derived key can ...
Ruben De Smet's user avatar
11 votes

Why OpenSSH prefers ECDSA nistp256 keys over -384 and -521, and those over Ed25519, for host key verification?

If I remember correctly, it is simply an issue of performance. Remember, HostKeyAlgorithms determines the method used to authenticate the server to the client, it ...
Richie Frame's user avatar
  • 13.1k
10 votes

ed25519 ssh public key is always 80 characters long?

To add more context: 25519 stands for 2^255 - 19, the prime number that is the order of the finite field over which point coordinates are defined. As such, (compressed) keys will never be longer than ...
Arne Vogel's user avatar
10 votes
Accepted

Shor algorithm and schnorr signature in ed25519

Shor's algorithm can compute discrete logs in elliptic curves and thereby recover the secret scalar from a public Ed25519 key, which you can use to forge signatures of your choice. So, yes, it ...
Squeamish Ossifrage's user avatar
10 votes
Accepted

Ed25519 PKCS8 private key example from IETF draft seems malformed

That example private key is not encoded with PKCS#8, but with the format described in RFC 5958, which is supposed to replace PKCS#8 (at least, in IETF parlance, RFC 5958 "obsoletes" RFC 5208,...
Thomas Pornin's user avatar
10 votes

Elliptic curve ed25519 vs ed448 - Differences

The Ed25519 prime has $p \equiv 1 \pmod 4$, while Ed448 has $p \equiv 3 \pmod 4$. This influences the square root algorithm. The $a$ elliptic curve parameter is $-1$ in Ed25519, and $1$ in Ed448. This ...
Conrado's user avatar
  • 6,464
10 votes
Accepted

What is "spinal-tap grade" security?

It is security on a 0-10 scale that goes to 11. The cost of cryptanalysis to break a cryptosystem with a 128-bit security level, like Ed25519, is out of reach for humanity already. A higher security ...
Squeamish Ossifrage's user avatar
10 votes

Raw curve25519 public key points

(minisign author here) As noted by corpsfini, keys encode the Y coordinate. The X coordinate is recovered using the curve equation: X = sqrt((Y^2 - 1) / (d Y^2 + 1)). The square root has two ...
Frank Denis's user avatar
  • 2,973
10 votes
Accepted

Raw curve25519 public key points

The leading 04 byte is specified by the SEC standard (which is based on the ANSI X9.62 standard). It indicates that the public key point is not compressed. If the ...
Conrado's user avatar
  • 6,464
10 votes

Why OpenSSH prefers ECDSA nistp256 keys over -384 and -521, and those over Ed25519, for host key verification?

So I got curious as to how fast things actually are. Apparently you can use $ openssl speed to see how fast certain operations are. I am not sure, however, as to ...
squirrel's user avatar
  • 331
10 votes
Accepted

"Cropping" the resulting shared secret from ECDH

You should apply the hash. If one follows the specification there are only roughly $2^{251}$ possible shared secret values and there is a simple test to see if a putative 32 bytes represents a ...
Daniel S's user avatar
  • 23.9k
9 votes
Accepted

ed25519 ssh public key is always 80 characters long?

Is there an option/param like when creating RSA keys that may influence the length of the key, or by design will always be 80 (68 removing the ssh-ed25519) characters? No, there can't be any such ...
SEJPM's user avatar
  • 46.1k
9 votes

Converting a C25519 curve into a NIST-supported curve for FIPS crypto

No, conversion of an EC key pair from a curve to another of unrelated order is not possible. One of the closest things that could be done would be that parties generate a new P256 key pair, then ...
fgrieu's user avatar
  • 142k
9 votes
Accepted

EdDSA (Ed25519) is any random number sufficient for a good private key?

Yes. In order to understand why, you need to understand how the public key is computed. The secret key is a scalar. A fixed base point is multiplied by that scalar, and no matter what that scalar ...
Frank Denis's user avatar
  • 2,973
9 votes

Why are NaCl secret keys 64 bytes for signing, but 32 bytes for box?

Opening and sealing a box involves your private scalar and the other party's public key. So the private key is simply the private scalar. Signing with Ed25519 involves your private scalar and your ...
CodesInChaos's user avatar
  • 24.9k

Only top scored, non community-wiki answers of a minimum length are eligible