Re: [Cfrg] Curve25519 lacks private/public homomorphism?

[Tony Arcieri <[e-mail]>]

On Tue, Feb 5, 2019 at 11:38 AM Dan Brown <[e-mail]> wrote:

> Hmm, I thought that this question was about X25519, but now it seems to be
> about EdDSA (Ed25519)?
>

Correct, where the original question was about D-H (X25519), Ed25519-BIP32
describes a similar scheme based on addition instead of scalar
multiplication, but in this case, for the purpose of signatures.

The basic idea is the same though, and underneath both schemes are
"Curve25519", with Ed25519-BIP32 using the "edwards25519" (RFC 8032
terminology) form. You could implement an Ed25519-BIP32 like scheme in
terms of X25519, or vice versa, but you will encounter the same problems.


> I see that BIP32 talks about updating the “after hash” private key? Is
> such modification the key generation generally considered compliant to CFRG
> spec RFC 8032?
>

This is indeed a big problem. I'm not going to attempt to play RFC lawyer,
but rather just say that in practice no Ed25519 library provides any of
this in the public API. In practice what I've seen, over and over again in
codebases where people try to extend Ed25519 with these features, is they
take the code from ed25519.c/go/etc, make the private APIs public, and muck
around with it at an extremely low level, sometimes just naively removing
clamping ("what is this for?"), or clamping repeatedly and therefore losing
key strength.

Without something like Ristretto, I'm not sure it's *possible* to define a
safe API that would allow an RFC 8032-compliant Ed25519 signer to derive a
unique private scalar based upon some agreed upon protocol which the
verifier can also do offline without coordination from the signer, in such
a way that is *misuse resistant* and "pluggable", i.e. not coupled to a
particular key derivation / blinding scheme.

Even if it were possible, I still don't think it's a good idea, and that's
kind of a shame, because it means Ed25519 signatures aren't composable in a
way, say, ECDSA signatures over a curve of prime order are, such as in the
original "BIP32" (which is used in conjunction with secp256k1).

-- 
Tony Arcieri