Taming the Many EdDSAs

Chalkias, Konstantinos; Garillot, François; Nikolaenko, Valeria

doi:10.1007/978-3-030-64357-7_4

Cited by 13 publications

(7 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…c = #E(F p )/ ) to ensure that A does not have low order. However, due to the lack of key validation, the Ed25519 signature scheme can not guarantee non-repudiation or resilience to key-substitution attacks (see [11,Sect. A] for an example).…”

Section: Compatibility With Other Ecc Librariesmentioning

confidence: 99%

“…As analyzed in e.g. [11,16], existing implementations of variants or tweaks of Ed25519 differ with respect to the following aspects.…”

Section: Compatibility With Other Ecc Librariesmentioning

confidence: 99%

“…This is especially problematic when an Ed25519 signature is verified by many entities seeking for a consensus (e.g. contract signing, electronic voting, blockchain transactions [11]).…”

Section: Compatibility With Other Ecc Librariesmentioning

confidence: 99%

See 2 more Smart Citations

Lightweight EdDSA Signature Verification for the Ultra-Low-Power Internet of Things

Großschädl

Franck

Liu

2021

Information Security Practice and Experience

View full text Add to dashboard Cite

EdDSA is a digital signature scheme based on elliptic curves in Edwards form that is supported in the latest incarnation of the TLS protocol (i.e. TLS version 1.3). The straightforward way of verifying an EdDSA signature involves a costly double-scalar multiplication of the form kP − lQ where P is a "fixed" point (namely the generator of the underlying elliptic-curve group) and Q is only known at run time. This computation makes a verification not only much slower than a signature generation, but also more memory demanding. In the present paper we compare two implementations of EdDSA verification using Ed25519 as case study; the first is speed-optimized, while the other aims to achieve low RAM footprint. The speed-optimized variant performs the doublescalar multiplication in a simultaneous fashion and uses a Joint-Sparse Form (JSF) representation for the two scalars. On the other hand, the memory-optimized variant splits the computation of kP − lQ into two separate parts, namely a fixed-base scalar multiplication that is carried out using a standard comb method with eight pre-computed points, and a variable-base scalar multiplication, which is executed by means of the conventional Montgomery ladder on the birationally-equivalent Montgomery curve. Our experiments with a 16-bit ultra-low-power MSP430 microcontroller show that the separated method is 24% slower than the simultaneous technique, but reduces the RAM footprint by 40%. This makes the separated method attractive for "lightweight" cryptographic libraries, in particular if both Ed25519 signature generation/verification and X25519 key exchange need to be supported.

show abstract

Section: Compatibility With Other Ecc Librariesmentioning

confidence: 99%

“…As analyzed in e.g. [11,16], existing implementations of variants or tweaks of Ed25519 differ with respect to the following aspects.…”

Section: Compatibility With Other Ecc Librariesmentioning

confidence: 99%

See 1 more Smart Citation

Lightweight EdDSA Signature Verification for the Ultra-Low-Power Internet of Things

Großschädl

Franck

Liu

2021

Information Security Practice and Experience

View full text Add to dashboard Cite

show abstract

“…Input points might however lie outside of that subgroup, leading to potential trouble in some protocols, because that allows the existence of distinct curve points which are still "equivalent" in the sense that they differ only by a small order point [CJ19]. Even in the simple case of signatures, the non-trivial cofactor f can lead to different implementations disagreeing on whether a given signature (maliciously crafted by the signer) is valid or not, which can break consensus protocols [CGN20].…”

Section: Introductionmentioning

confidence: 99%

A Prime-Order Group with Complete Formulas from Even-Order Elliptic Curves

Pornin

2024

IACR CiC

View full text Add to dashboard Cite

This paper describes a generic methodology for obtaining unified, and then complete formulas for a prime-order group abstraction homomorphic to a subgroup of an elliptic curve with even order. The method is applicable to any curve with even order, in finite fields of both even and odd characteristic; it is most efficient on curves with order equal to 2 modulo 4, dubbed "double-odd curves". In large characteristic fields, we obtain doubling formulas with cost as low as 1M + 5S, and the resulting group allows building schemes such as signatures that outperform existing fast solutions, e.g. Ed25519. In binary fields, the obtained formulas are not only complete but also faster than previously known incomplete formulas; we can sign and verify in as low as 18k and 27k cycles on x86 CPUs, respectively.

show abstract

“…Using a Type 3 curve in this analysis gives a fairer comparison to pairings-free schemes. Both ED25519 and BN462 provide 128-bit security[42][43]. As can be seen from Fig.3, on the tested hardware the schemes using pairings (shown with a dashed outline) were much slower for both signature generation and verification than pairing-free schemes.…”

mentioning

confidence: 98%

Pairing-Free Signatures With Insider-Attack Resistance for Vehicular Ad-Hoc Networks (VANETs)

2021

View full text Add to dashboard Cite

Vehicular Ad-hoc Networks (VANETs) are a type of Internet of Things system where groups of vehicles communicate with each other and traffic monitoring infrastructure in order to provide safety and quality of life improvements for drivers and others in the area. Vehicles in a VANET are responsible for reporting their own status, as well as the statuses of the roadway, traffic, and environment in their immediate vicinity, to the system controller and other drivers for processing. VANET systems are open to the public, with vehicles joining and leaving at a high rate. This feature results in two high-priority requirements for VANET security: vehicles in a VANET must be held responsible for the correctness of the information that they report, and schemes ensuring message security must be quick. This paper presents an efficient, pairingfree signature scheme for VANETs that prevents the forgery of signer identities, including in the case of insider attacks, without the use of a tamper-proof device.

show abstract

Taming the Many EdDSAs

Cited by 13 publications

References 23 publications

Lightweight EdDSA Signature Verification for the Ultra-Low-Power Internet of Things

Lightweight EdDSA Signature Verification for the Ultra-Low-Power Internet of Things

A Prime-Order Group with Complete Formulas from Even-Order Elliptic Curves

Pairing-Free Signatures With Insider-Attack Resistance for Vehicular Ad-Hoc Networks (VANETs)

Contact Info

Product

Resources

About