Hot answers tagged

51 votes

Why Curve25519 for encryption but Ed25519 for signatures?

While it is true that Elliptic Curve Diffie Hellman (ECDH), Elliptic Curve Signature Generation (ECDSA), and Elliptic Curve Signature Verification rely on scalar multiplications, these are usually ...
user avatar
  • 6,329
51 votes
Accepted

Is it bad to expose the public key?

From a cryptographic standpoint it is OK to expose a public key in the sense of revealing its value. The most basic assumption in cryptography involving public/private key pairs is that the value of a ...
user avatar
  • 124k
40 votes
Accepted

ECDSA, EdDSA and ed25519 relationship / compatibility

Ed25519 is a specific instance of the EdDSA family of signature schemes. Ed25519 is specified in RFC 8032 and widely used. The only other instance of EdDSA that anyone cares about is Ed448, which is ...
user avatar
37 votes
Accepted

Elliptic curve ed25519 vs ed448 - Differences

Edwards25519 is the twisted Edwards curve $$-x^2 + y^2 = 1 - (121665/121666) x^2 y^2$$ over the prime field $\mathbb F_p$ where $p = 2^{255} - 19$. The coefficient $d = -121665/121666$ was chosen to ...
user avatar
31 votes

Why Curve25519 for encryption but Ed25519 for signatures?

The old terminology was confusing, so they've rebranded a bit. X25519 is Elliptic Curve Diffie-Hellman (ECDH) over Curve25519 Ed25519 is Edwards-curve Digital Signature Algorithm (EdDSA) over ...
user avatar
22 votes
Accepted

Curve25519 over Ed25519 for key exchange? Why?

There's a few different related parts here, and the nomenclature of the library you've cited is a little confusing. Curve25519 is an elliptic curve over the finite field $\mathbb F_p$, where $p = 2^{...
user avatar
21 votes
Accepted

Edwards / Montgomery ECC with Weierstrass Implementation?

If I understand your question correctly, you are essentially asking if points in Edwards and Montgomery curves can be represented in Weierstrass coordinates. This is true; in fact, any elliptic curve ...
user avatar
  • 11.7k
21 votes
Accepted

How many qubits are required to break RSA 2048 or 4096 with a universal quantum computer?

How many qubits are required for breaking RSA 2048 and RSA 4096 in real-time with a quantum computer? Like the answer you linked to shows, about $\log_2(N^2) = 2 \log_2(N)$ or just $2n$ where $n$ ...
user avatar
  • 31.3k
16 votes
Accepted

Difference between X25519 vs. Ed25519

Is X25519 and Ed25519 the same curve? No. X25519 isn't a curve, it's an Elliptic-Curve Diffie-Hellman (ECDH) protocol using the x coordinate of the curve ...
user avatar
15 votes
Accepted

Ed25519 cryptanalysis and backdoor?

if Ed25519 has gone through rigorous cryptanalysis It is based on Curve25519 which has gone through extensive cryptanalysis. The Ed25519 signature scheme as well is being heavily reviewed and ...
user avatar
  • 13.3k
14 votes

Why Curve25519 for encryption but Ed25519 for signatures?

Curve25519 makes use of a special x-coordinate only form to achieve faster multiplication. Ed25519 uses Edwards curve for similar speedups, but includes a sign bit. While it could have been done ...
user avatar
14 votes

Is it bad to expose the public key?

The advent of quantum computing, real usable out of the lab QC, will pretty much be the end of any encryption that relies on the difficulty of the discrete log problem via Shor's Algorithm et al. That ...
user avatar
13 votes
Accepted

Can curve25519 keys be used with ed25519 keys?

Trevor Perrin wrote a library doing exactly that. Explanation can be found on in the curves mailing list archives. To convert a Curve25519 public key $x_C$ into an Ed25519 public key $y_E$, with a ...
user avatar
12 votes
Accepted

What are the differences between the elliptic curve equations?

All of these are answered by the SafeCurves project: For twisted Edwards curves, $ax^2 + y^2 \equiv 1 + dx^2y^2 \pmod p$. Edwards curves are the special case a = 1. Edwards curves can be converted to ...
user avatar
12 votes
Accepted

How to obtain 256-bit security from Ed25519?

It is not possible to double security level of Ed25519 any trivial way. Instead, doubling security level requires using another curve that is approximately 512 bit curve. In systems compliant with RFC ...
user avatar
  • 5,239
12 votes

Can I use signature(hash(message)) instead of signature(message)?

Yes, this should be secure. I am not familiar with TweetNaCl, so I cannot speak on the concrete implementation. However, the general construction of signing a hash of a message instead of the ...
user avatar
  • 2,857
12 votes
Accepted

Curve 25519 (X25519, Ed25519) Convert coordinates between Montgomery curve and twisted Edwards curve

The formulas actually work. You just have to keep in mind to make computation in the field of intergers modulo $2^{255}-19$ and that there are actually two square roots, you need to use the right one ...
user avatar
  • 6,329
10 votes
Accepted

How to derive the curve Ed25519 from Curve25519?

First off, your equation is correct and there seems to be no calculation mistake. To understand on how to get from $$(2+d)x^{2}+dy^{2}=d+(d-2)x^{2}y^{2}$$ to $$x^{2}+y^{2}=1+e\cdot x^{2}y^{2}$$ ...
user avatar
  • 44.6k
10 votes
Accepted

Ed25519 PKCS8 private key example from IETF draft seems malformed

That example private key is not encoded with PKCS#8, but with the format described in RFC 5958, which is supposed to replace PKCS#8 (at least, in IETF parlance, RFC 5958 "obsoletes" RFC 5208,...
user avatar
10 votes
Accepted

Is it possible to derive a public key from another public key without knowing a private key (Ed25519)?

Yes! You can use the ephemeral key derivation mechanism that is for example used in Monero (they call it stealth keys there). Consider public key $A=aG$, with private key $a$. Then, a derived key can ...
user avatar
9 votes

Converting a C25519 curve into a NIST-supported curve for FIPS crypto

No, conversion of an EC key pair from a curve to another of unrelated order is not possible. One of the closest things that could be done would be that parties generate a new P256 key pair, then ...
user avatar
  • 124k
9 votes
Accepted

Shor algorithm and schnorr signature in ed25519

Shor's algorithm can compute discrete logs in elliptic curves and thereby recover the secret scalar from a public Ed25519 key, which you can use to forge signatures of your choice. So, yes, it ...
user avatar
9 votes
Accepted

Is every bytestring a valid Ed25519 private key?

There are a few different formats for the standard parts of an Ed25519 private key, which are usually stored as 32-byte or 64-byte strings, so you need to pay attention to the choices made by the ...
user avatar
9 votes
Accepted

What is "spinal-tap grade" security?

It is security on a 0-10 scale that goes to 11. The cost of cryptanalysis to break a cryptosystem with a 128-bit security level, like Ed25519, is out of reach for humanity already. A higher security ...
user avatar
9 votes

Raw curve25519 public key points

(minisign author here) As noted by corpsfini, keys encode the Y coordinate. The X coordinate is recovered using the curve equation: X = sqrt((Y^2 - 1) / (d Y^2 + 1)). The square root has two ...
user avatar
  • 2,764
9 votes
Accepted

Why are ed25519 keys not recommended for encryption?

You seem confused about a few things. Bear with me, this is a very common confusion! Encryption is defined with the intent of confidentially transporting information: if you encrypt information, it ...
user avatar
8 votes
Accepted

Is Curve25519 vulnerable to private key exposure in the case of a bad RNG?

Any key generation algorithm for any cryptosystem is going to be weak if the attacker can predict what seed was used to generate the key. They can just generate the same key. However, assuming the the ...
user avatar
  • 31.3k
8 votes

ed25519 ssh public key is always 80 characters long?

To add more context: 25519 stands for 2^255 - 19, the prime number that is the order of the finite field over which point coordinates are defined. As such, (compressed) keys will never be longer than ...
user avatar
8 votes

Why are NaCl secret keys 64 bytes for signing, but 32 bytes for box?

Opening and sealing a box involves your private scalar and the other party's public key. So the private key is simply the private scalar. Signing with Ed25519 involves your private scalar and your ...
user avatar
8 votes
Accepted

libsodium x25519 and Ed25519 small order check

Short answer: You don't need to worry about the blacklist or point validation unless you are designing an exotic protocol. Medium answer: It depends on what you are trying to do. There is a short ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible