Is this half-smart way of verifying EdDSA signature secure?

DannyNiu

9/6/23, 9:12 AM

In the final step of verifying an EdDSA signature, 4[S]B is compared to [4]R + [4][k]A.

Because I'm using the XYTZ - extended twisted Edwards coordinates, I want to, for efficiency reasons, do:

$$ Y(\text{Left}) \cdot Z(\text{Right}) = Y(\text{Right}) \cdot Z(\text{Left})$$,

But that leaves the X coordinates unchecked.

Can this check be secure?

0 + 0

implementation

eddsa

kelalaka

9/6/23, 6:00 PM

For each $Y$ coordinate there can be two $X$ coordinates. Can you see that?

DannyNiu

9/7/23, 1:27 AM

From the way [RFC-8032](https://datatracker.ietf.org/doc/html/rfc8032) describes the encoding and decoding of points, I can see that. I used the words "half-smart" because I'm not sure if the choice of X is significant in signature verification.

Score:3

Crypto

Daniel S

9/7/23, 11:40 PM

Well, the checking procedure itself is not SUF-CMA as one can generate a second valid signature by replacing $R$ with $R+I$ where $I$ is a point of order divisible by 4.

By not checking the $X$ coordinate, you increase the number of secondary forgeries because $S$ can be replaced by $\ell-S$ or $R$ can be replaced with $R+I$ or both.

However, since the SUF-CMA security is already absent, the additional security loss is minimal. Only in cases where SUF-CMA is important and implementers decide to block it by not allowing signatures with duplicate $S$ values or by disallowing points $R$ that are not of order $\ell$ would your checking procedure introduce new attacks.

0 + 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Is this half-smart way of verifying EdDSA signature secure?

TH: วิธีตรวจสอบลายเซ็น EdDSA แบบครึ่งทางนี้ปลอดภัยหรือไม่

RO: Este sigur acest mod pe jumătate inteligent de a verifica semnătura EdDSA?

RU: Безопасен ли этот наполовину умный способ проверки подписи EdDSA?

VI: Đây có phải là cách nửa thông minh để xác minh chữ ký EdDSA an toàn không?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.