Score:2

Crypto

Using same private key for both X25519 and ECDSA (using curve25519)

jjd

6/4/23, 9:01 AM

I'm writing an application where both encryption/decryption and signing/verification are needed, and I choose X25519 as a key agreement algorithm which will produce a key for encryption, and ECDSA to sign messages.

Key generation: I generate a curve25519 private key from a mnemonic (so I have kind of a random 32 bytes private key).

Now I have 32 bytes array, I want to use this array byte array for both encryption and signing, the problem that I have is, for X25519 i need to apply key clamping for this private key to be valid which looks like this:

privateKey[0] &= 248;    // unset the 3 least significant bits
privateKey[31] &= 127   // unset the most significant bit
privateKey[31] |= 64      // set the second most significant bit

But for ECDSA, the key needs to be in the range $[1, N]$, where N (for curve25519) is equal to $2^{252}$ + a small factor, and so I need to convert my 32 bytes array to a number that fits in this range.

I have a few questions:

Why doesn't the X25519 private key need to fit in the range $[1, N]$?
Also why is it not important to apply the key clamping function used in X25519 to the key used for ECDSA?

180

0 + 0

elliptic-curves

signature

dsa

diffie-hellman

x25519

knaccc

6/4/23, 9:14 AM

Don't use the same private key directly for signing and encryption. Use HKDF-Expand on your uniformly random 32-byte master key to generate separate signing and encryption keys. Then let your libraries clamp or reduce them mod N in whatever ways they deem necessary.

Maarten Bodewes

6/4/23, 10:28 AM

Hi jjd & welcome. I've removed the Bouncy Castle / implementation part; that's for [so] or maybe [codereview.se]; it's off topic here. Please reread and clean up your question before posting, users should not have to perform e.g. capitalization for you.

jjd

6/4/23, 11:18 AM

thanks knaccc you're answer was helpful!

jjd

6/4/23, 11:19 AM

i'll make sure to follow the rules next time my bad.

kelalaka

6/4/23, 12:49 PM

Does this answer your question? 1) [Public Key generation for Ed25519 vs X25519](https://crypto.stackexchange.com/questions/76156/public-key-generation-for-ed25519-vs-x25519) 2) [Using a single Ed25519 key for encryption and signature](https://crypto.stackexchange.com/q/37896/18298) 3) [Using same private key for both X25519 and ECDSA (using curve25519)](https://crypto.stackexchange.com/q/63732/18298)

jjd

6/6/23, 12:44 PM

it does, thanks!

Score:3

Crypto

meshcollider

6/4/23, 10:52 AM

Why doesn't the X25519 private key need to fit in the range $[1,N]$?

By unsetting the most significant bit and the three least significant bits, you limit the key to effectively only 252 bits. When you say $N$ is $2^{252}$ + a small factor, you are talking about the order of the subgroup used by x25519, not the full order of the curve group. This subgroup has index (or cofactor) 8. Unsetting the three lower bits forces the secret to be a multiple of 8, meaning it will lie in this large prime-order subgroup.

Also why is it not important to apply the key clamping function used in X25519 to the key used for ECDSA?

To the best of my knowledge, Curve25519 is not used for ECDSA. Did you mean EdDSA (specifically, ed25519)?

0 + 0

jjd

6/4/23, 11:23 AM

Thanks for your answer! you're correct, i think curve25519 for ECDSA is a bad choice from my side, i'm thinking about using EdDSA now, i know that EdDSA and X25519 use different curves, but they're using the same key clamping function right, is it safe to use the same private key(but different public keys) for both EdDSA and X25519, or is it safer if I derive two different keys using my random 32 bytes?

meshcollider

6/4/23, 11:35 AM

You should definitely derive two separate keys. Reusing keys almost always has unforseen security complications. Btw, please remember to accept and upvote the answer if it helped!

jjd

6/4/23, 11:39 AM

just did, i need at least 15 reputation to upvote tho, thx for the answer!

dave_thompson_085

6/5/23, 3:40 AM

@jjd: actually Ed25519 (a popular instance of EdDSA) and X25519 use the same _curve_ mathematically, but different representations -- X25519 uses Montgomery form and and Ed25519 uses Edwards form, and these forms have different coefficients and calculations, but they are what mathemeticians call birationally equivalent. See https://datatracker.ietf.org/doc/html/rfc7748 .

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Using same private key for both X25519 and ECDSA (using curve25519)

TH: ใช้คีย์ส่วนตัวเดียวกันสำหรับทั้ง X25519 และ ECDSA (ใช้ curve25519)

RO: Folosind aceeași cheie privată atât pentru X25519, cât și pentru ECDSA (folosind curve25519)

RU: Использование одного и того же закрытого ключа для X25519 и ECDSA (с использованием curve25519)

VI: Sử dụng cùng một khóa riêng cho cả X25519 và ECDSA (sử dụng curve25519)

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.