62
votes
Why Curve25519 for encryption but Ed25519 for signatures?
While it is true that Elliptic Curve Diffie Hellman (ECDH), Elliptic Curve Signature Generation (ECDSA), and Elliptic Curve Signature Verification rely on scalar multiplications, these are usually ...
- 7,144
55
votes
Accepted
Elliptic curve ed25519 vs ed448 - Differences
Edwards25519 is the twisted Edwards curve $$-x^2 + y^2 = 1 - (121665/121666) x^2 y^2$$ over the prime field $\mathbb F_p$ where $p = 2^{255} - 19$. The coefficient $d = -121665/121666$ was chosen to ...
- 49.1k
53
votes
Accepted
Is it bad to expose the public key?
From a cryptographic standpoint it is OK to expose a public key in the sense of revealing its value. The most basic assumption in cryptography involving public/private key pairs is that the value of a ...
- 144k
45
votes
Accepted
ECDSA, EdDSA and ed25519 relationship / compatibility
Ed25519 is a specific instance of the EdDSA family of signature schemes. Ed25519 is specified in RFC 8032 and widely used. The only other instance of EdDSA that anyone cares about is Ed448, which is ...
- 49.1k
39
votes
Why Curve25519 for encryption but Ed25519 for signatures?
The old terminology was confusing, so they've rebranded a bit.
X25519 is Elliptic Curve Diffie-Hellman (ECDH) over Curve25519
Ed25519 is Edwards-curve Digital Signature Algorithm (EdDSA) over ...
38
votes
Accepted
Curve25519 over Ed25519 for key exchange? Why?
There's a few different related parts here, and the nomenclature of the library you've cited is a little confusing.
Curve25519 is an elliptic curve over the finite field $\mathbb F_p$, where $p = 2^{...
- 49.1k
28
votes
Accepted
Difference between X25519 vs. Ed25519
Is X25519 and Ed25519 the same curve?
No. X25519 isn't a curve, it's an Elliptic-Curve Diffie-Hellman (ECDH) protocol using the x coordinate of the curve Curve25519. Ed25519 is an Edwards Digital ...
- 5,854
20
votes
Accepted
Why are ed25519 keys not recommended for encryption?
You seem confused about a few things. Bear with me, this is a very common confusion!
Encryption is defined with the intent of confidentially transporting information: if you encrypt information, it ...
- 2,430
15
votes
Accepted
Ed25519 cryptanalysis and backdoor?
if Ed25519 has gone through rigorous cryptanalysis
It is based on Curve25519 which has gone through extensive cryptanalysis. The Ed25519 signature scheme as well is being heavily reviewed and ...
- 15.4k
14
votes
Is it bad to expose the public key?
The advent of quantum computing, real usable out of the lab QC, will pretty much be the end of any encryption that relies on the difficulty of the discrete log problem via Shor's Algorithm et al. That ...
- 261
13
votes
Accepted
How to obtain 256-bit security from Ed25519?
It is not possible to double security level of Ed25519 any trivial way. Instead, doubling security level requires using another curve that is approximately 512 bit curve.
In systems compliant with RFC ...
- 5,349
13
votes
Accepted
Why Ed25519 encodes y-coordinates rather than x-coordinates
This was a concern for patent reasons. As fgrieu mentions, you can recover one coordinate from the other on Edwards curves, so it doesn't matter which you encode. However, as this answer mentions, ...
- 3,516
12
votes
Can I use signature(hash(message)) instead of signature(message)?
Yes, this should be secure.
I am not familiar with TweetNaCl, so I cannot speak on the concrete implementation. However, the general construction of signing a hash of a message instead of the ...
- 2,897
12
votes
Accepted
Curve 25519 (X25519, Ed25519) Convert coordinates between Montgomery curve and twisted Edwards curve
The formulas actually work.
You just have to keep in mind to make computation in the field of intergers modulo $2^{255}-19$ and that there are actually two square roots, you need to use the right one ...
- 7,144
11
votes
Accepted
Is it possible to derive a public key from another public key without knowing a private key (Ed25519)?
Yes! You can use the ephemeral key derivation mechanism that is for example used in Monero (they call it stealth keys there).
Consider public key $A=aG$, with private key $a$. Then, a derived key can ...
- 2,430
11
votes
Why OpenSSH prefers ECDSA nistp256 keys over -384 and -521, and those over Ed25519, for host key verification?
If I remember correctly, it is simply an issue of performance. Remember, HostKeyAlgorithms determines the method used to authenticate the server to the client, it ...
- 13.2k
10
votes
ed25519 ssh public key is always 80 characters long?
To add more context: 25519 stands for 2^255 - 19, the prime number that is the order of the finite field over which point coordinates are defined. As such, (compressed) keys will never be longer than ...
- 201
10
votes
Accepted
EdDSA (Ed25519) is any random number sufficient for a good private key?
Yes.
In order to understand why, you need to understand how the public key is computed.
The secret key is a scalar. A fixed base point is multiplied by that scalar, and no matter what that scalar ...
- 3,033
10
votes
Accepted
Shor algorithm and schnorr signature in ed25519
Shor's algorithm can compute discrete logs in elliptic curves and thereby recover the secret scalar from a public Ed25519 key, which you can use to forge signatures of your choice.
So, yes, it ...
- 49.1k
10
votes
Accepted
Ed25519 PKCS8 private key example from IETF draft seems malformed
That example private key is not encoded with PKCS#8, but with the format described in RFC 5958, which is supposed to replace PKCS#8 (at least, in IETF parlance, RFC 5958 "obsoletes" RFC 5208,...
- 87.7k
10
votes
Elliptic curve ed25519 vs ed448 - Differences
The Ed25519 prime has $p \equiv 1 \pmod 4$, while Ed448 has $p \equiv 3 \pmod 4$. This influences the square root algorithm.
The $a$ elliptic curve parameter is $-1$ in Ed25519, and $1$ in Ed448. This ...
- 6,514
10
votes
Accepted
What is "spinal-tap grade" security?
It is security on a 0-10 scale that goes to 11.
The cost of cryptanalysis to break a cryptosystem with a 128-bit security level, like Ed25519, is out of reach for humanity already. A higher security ...
- 49.1k
10
votes
Raw curve25519 public key points
(minisign author here)
As noted by corpsfini, keys encode the Y coordinate. The X coordinate is recovered using the curve equation: X = sqrt((Y^2 - 1) / (d Y^2 + 1)).
The square root has two ...
- 3,033
10
votes
Accepted
Raw curve25519 public key points
The leading 04 byte is specified by the SEC standard (which is based on the ANSI X9.62 standard). It indicates that the public key point is not compressed. If the ...
- 6,514
10
votes
Why OpenSSH prefers ECDSA nistp256 keys over -384 and -521, and those over Ed25519, for host key verification?
So I got curious as to how fast things actually are. Apparently you can use $ openssl speed to see how fast certain operations
are. I am not sure, however, as to ...
- 341
10
votes
Accepted
"Cropping" the resulting shared secret from ECDH
You should apply the hash. If one follows the specification there are only roughly $2^{251}$ possible shared secret values and there is a simple test to see if a putative 32 bytes represents a ...
- 25.4k
9
votes
Accepted
ed25519 ssh public key is always 80 characters long?
Is there an option/param like when creating RSA keys that may
influence the length of the key, or by design will always be 80 (68
removing the ssh-ed25519) characters?
No, there can't be any such ...
- 46.3k
9
votes
Converting a C25519 curve into a NIST-supported curve for FIPS crypto
No, conversion of an EC key pair from a curve to another of unrelated order is not possible.
One of the closest things that could be done would be that parties generate a new P256 key pair, then
...
- 144k
9
votes
Why are NaCl secret keys 64 bytes for signing, but 32 bytes for box?
Opening and sealing a box involves your private scalar and the other party's public key. So the private key is simply the private scalar.
Signing with Ed25519 involves your private scalar and your ...
- 25k
9
votes
Accepted
libsodium x25519 and Ed25519 small order check
Short answer: You don't need to worry about the blacklist or point validation unless you are designing an exotic protocol.
Medium answer:
It depends on what you are trying to do. There is a short ...
- 49.1k
Only top scored, non community-wiki answers of a minimum length are eligible