# Tag Info

### Why Curve25519 for encryption but Ed25519 for signatures?

While it is true that Elliptic Curve Diffie Hellman (ECDH), Elliptic Curve Signature Generation (ECDSA), and Elliptic Curve Signature Verification rely on scalar multiplications, these are usually ...
Accepted

### Is it bad to expose the public key?

From a cryptographic standpoint it is OK to expose a public key in the sense of revealing its value. The most basic assumption in cryptography involving public/private key pairs is that the value of a ...
Accepted

### Elliptic curve ed25519 vs ed448 - Differences

Edwards25519 is the twisted Edwards curve $$-x^2 + y^2 = 1 - (121665/121666) x^2 y^2$$ over the prime field $\mathbb F_p$ where $p = 2^{255} - 19$. The coefficient $d = -121665/121666$ was chosen to ...
Accepted

### ECDSA, EdDSA and ed25519 relationship / compatibility

Ed25519 is a specific instance of the EdDSA family of signature schemes. Ed25519 is specified in RFC 8032 and widely used. The only other instance of EdDSA that anyone cares about is Ed448, which is ...

### Why Curve25519 for encryption but Ed25519 for signatures?

The old terminology was confusing, so they've rebranded a bit. X25519 is Elliptic Curve Diffie-Hellman (ECDH) over Curve25519 Ed25519 is Edwards-curve Digital Signature Algorithm (EdDSA) over ...
Accepted

### ed25519 ssh public key is always 80 characters long?

To add more context: 25519 stands for 2^255 - 19, the prime number that is the order of the finite field over which point coordinates are defined. As such, (compressed) keys will never be longer than ...
Accepted

### Shor algorithm and schnorr signature in ed25519

Shor's algorithm can compute discrete logs in elliptic curves and thereby recover the secret scalar from a public Ed25519 key, which you can use to forge signatures of your choice. So, yes, it ...
Accepted

### Ed25519 PKCS8 private key example from IETF draft seems malformed

That example private key is not encoded with PKCS#8, but with the format described in RFC 5958, which is supposed to replace PKCS#8 (at least, in IETF parlance, RFC 5958 "obsoletes" RFC 5208,...
Accepted

### What is "spinal-tap grade" security?

It is security on a 0-10 scale that goes to 11. The cost of cryptanalysis to break a cryptosystem with a 128-bit security level, like Ed25519, is out of reach for humanity already. A higher security ...

### Raw curve25519 public key points

(minisign author here) As noted by corpsfini, keys encode the Y coordinate. The X coordinate is recovered using the curve equation: X = sqrt((Y^2 - 1) / (d Y^2 + 1)). The square root has two ...
Accepted

### Raw curve25519 public key points

The leading 04 byte is specified by the SEC standard (which is based on the ANSI X9.62 standard). It indicates that the public key point is not compressed. If the ...
Accepted

### ed25519 ssh public key is always 80 characters long?

Is there an option/param like when creating RSA keys that may influence the length of the key, or by design will always be 80 (68 removing the ssh-ed25519) characters? No, there can't be any such ...

### Converting a C25519 curve into a NIST-supported curve for FIPS crypto

No, conversion of an EC key pair from a curve to another of unrelated order is not possible. One of the closest things that could be done would be that parties generate a new P256 key pair, then ...
Accepted

### EdDSA (Ed25519) is any random number sufficient for a good private key?

Yes. In order to understand why, you need to understand how the public key is computed. The secret key is a scalar. A fixed base point is multiplied by that scalar, and no matter what that scalar ...

### Why are NaCl secret keys 64 bytes for signing, but 32 bytes for box?

Opening and sealing a box involves your private scalar and the other party's public key. So the private key is simply the private scalar. Signing with Ed25519 involves your private scalar and your ...