Re: [Cfrg] Interest in an "Ed25519-HD" standard?

[Aaron Zauner <[e-mail]>]

Hi,

> On 21 Mar 2017, at 20:42, Tony Arcieri <[e-mail]> wrote:
> 
> Hierarchical key derivation (also sometimes described as "semiprivate keys" or "key blinding") is an increasingly popular technique for generating unlinkable child keys from master public and private keys.
> 
> The Tor Project has been exploring such an approach as the basis for their next-generation hidden services design for several years now[1], during which time it has received security proofs[2]. Their latest design[3] allegedly includes feedback from Dan Bernstein.
> 
> Application of hierarchical key derivation is perhaps most notable in the cryptocurrency space, where Bitcoin's BIP32[4] provided a means for unlinkable single-use signature keys for the secp256k1 elliptic curve. There are several designs for applying the ideas from BIP32 to Ed25519, including ones from Evernym[5] and Chain[6] (where I am an employee).
> 
> The designs in [3], [5], and [6] are all highly similar and accomplish the same goals. Personally I would love to see a single standard design for producing Ed25519 signatures from hierarchically derived keys, notably one which produces signatures that can be verified by any off-the-shelf RFC 8032-compatible Ed25519 implementation.
> 
> There's already been some discussion of this on the moderncrypto.org curves list:
> 
> https://moderncrypto.org/mail-archive/curves/2017/000858.html
> 
> I'd be curious to know if anyone else would be interested in collaborating on a draft for such a standard, which can be a synthesis of the existing work in this space.

I feel this is a useful input to CFRG and would be willing to review such a document. I think it's also a good idea if you talk to the original authors of the design documents you've linked to for collaboration.

Aaron