EdDSA notes

HTML5 logo
This page uses HTML5's MathML standard. Your browser might not support it.

Background

In 2014/2015 I implemented Ed25519-SHA-512 for a commercial software. I want to share notes with you, I took during the implementation. It might help you to implement EdDSA/Curve25519 yourself.

Software using Curve25519

See the wonderful list by ianix.com.

Terminology

EdDSA
A digital signature scheme (DSA) using Edwards curves (Ed). The specific curve and hash algorithm to use is unspecified.
Curve25519
The Montgomery curve y2 = x3 + 486662x2 + x
Ed25519
EdDSA using the Twisted Edwards curve -x2+y2 = 1- 121665121666x2y2 which is birationally equivalent to Curve25519
Ed25519-SHA-512
Ed25519 with the hash algorithm SHA-512

Relevant papers

Authors Name Date Link
Daniel J Bernstein, Chitchanok Chuengsatiansup, Tanja Lange “Curve41417: Karatsuba revisited” 2014 PDF
Daniel J Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, Bo-Yin Yang “High-speed high-security signatures” 2011 PDF
Huseyin Hisil, Kenneth Koon-Ho Wong, Gary Carter, Ed Dawson “Twisted Edwards Curves Revisited” 2008 PDF
Daniel J Bernstein, Peter Birkner, Marc Joye, Tanja Lange, Christiane Peters “Twisted Edwards Curves” 2008 PDF

The 2014 paper is not relevant for EdDSA, but listed here, because EdDSA is mostly implemented because of its performance. This paper introduces an even faster Curve41417 (formerly known as Curve3617).

The protocol itself

This digital signature scheme is defined in the 2011 paper.

DSA parameters

b=256 H=SHA-512 with 2b-bit output q=2255-19 l=2252+14DEF9DEA2F79CD65812631A5CF5D3ED16 d=-121665121666 B=(9,20AE19A1B8A086B4E01EDD2C7748D14C923D4D7E6D7C61B229E9C5A27ECED3D916)

Key pair generation

Given b random bytes k, we initialize:

hi=H(k)0i<2b a=2b-2+3ib-32ihi A=aB
  1. The private key is given as (a, hi)
  2. The public key is given as (A)

Signing

Given a message M as sequence of bytes. Let underline denote the little-endian b-bit encoding of a point meaning that index 0 contains the LSB of the y-coordinate and index b-1 contains the MSB of y, but set the highest bit if and only if the lower bit of x is set.

r=H(hb,,h2b-1,M) R=rB S=r+H(R¯,A¯,M¯)amodl (R¯,S¯)

Verifying

Accept (R¯,S¯) if and only if

8SB =? 8R+8H(R¯,A¯,M¯)A

Remark

If you are still wondering about the steps, this Ed25519 article by Brian Warner should give you a good start for your implementation.

Notes & resources