elliptic-curve签名验证verify signature in EdDSA

特别地，https://slowli.github.io/ed25519-quirks/ 这个网站的内容很清晰。

1. signature in EdDSA

详细的EdDSA签名和验签过程可参看 rfc8032 Edwards-Curve Digital Signature Algorithm (EdDSA)
。

参照博客Schnorr signature (Schnorr 签名)数学原理类似，签名过程如下：

A=kGA=kGA=kG, kkk is private, A is public key, G is a standard elliptic-curve point.
R=rGR=rGR=rG, rrr 为 random-once随机数，每次需分别单独生成，R is public。
h=Hash(R∣∣A∣∣m)h=Hash(R||A||m)h=Hash(R∣∣A∣∣m), mmm is the message to be signed.
s=r+khs=r+khs=r+kh, (R,s)(R,s)(R,s) is the signature for message mmm.

∵sG=rG+khG=R+hA\because sG=rG+khG=R+hA∵sG=rG+khG=R+hA
∴R=sG−hA\therefore R=sG-hA∴R=sG−hA

验签时，(R,s),A,m,G(R,s),A,m,G(R,s),A,m,G均已知，其中的A/G/RA/G/RA/G/R均为elliptic-curve point, 且为节省空间，A/RA/RA/R已compress。sss为scalar值。具体的验签过程如下：

h=Hash(R∣∣A∣∣m)h=Hash(R||A||m)h=Hash(R∣∣A∣∣m)
compress(sG−h∗decompress(A))?=Rcompress(sG-h*decompress(A))\ \ ?= Rcompress(sG−h∗decompress(A)) ?=R

以上验签过程支持fast batch verification以及fast batch forgery identification.

For elliptic-curve signatures at a 2b2^b2b security level it is standard practice to use about 2b2b2b bits for hashes, scalars, and field elements, and to compress points to single coordinates. EdDSA and Schnorr’s system then have the same signature size, about 4b bits.

(R,s)(R,s)(R,s) 为EdDSA格式的签名，(R,h)(R,h)(R,h)为Schnorr格式的签名。相比于ECDSA，去掉了求倒数的操作。

对于Schnorr格式的签名，当选择bbbbits的Hash函数时，最终Schnorr格式的签名可减少至3b3b3b bits.

decompress需要有额外的求平方根运算，为节约verify的验证时间，也可传递未被压缩的public keys和未压缩的签名。decompress解压缩的细节可参看博客edwards25519 point压缩及解压缩算法，求平方根运算见博客有限域内的平方根求解原理解析及curve25519-dalek中的实现.

基于Pairing-based的签名，其长度更小，大约为2b2b2b bits，但是pairing-based的验签速度要比elliptic-verve的验签速度慢一个数量级。

参考资料：
[1] 论文《Faster batch forgery identification》
[2] 博客Schnorr signature (Schnorr 签名)数学原理
[3] Edwards-Curve Digital Signature Algorithm (EdDSA)
[4] https://slowli.github.io/ed25519-quirks/
[5] https://yondon.blog/2019/01/01/how-not-to-use-ecdsa/

elliptic-curve签名验证verify signature in EdDSA相关推荐

Elliptic Curve Cryptography: finite fields and discrete logarithms
转载自:https://andrea.corbellini.name/2015/05/23/elliptic-curve-cryptography-finite-fields-and-discrete ...
Halo中的elliptic curve cycle
1. 引言 Bowe等人2019年论文<Halo: Recursive Proof Composition without a Trusted Setup>. 该论文中的部分verific ...
Elliptic Curve Cryptography: 轻轻的学
Elliptic Curve Cryptography: 轻轻的学 Elliptic curves Algebraic addition Scalar multiplication Multiplic ...
Elliptic curve cryptography
原文来自wiki 翻译参照Bing在线翻译 - - 部分翻译 Elliptic curve cryptography From Wikipedia, the free encyclopedia Jum ...
Elliptic curve Diffie–Hellman
原文地址:https://en.wikipedia.org/wiki/Elliptic_curve_Diffie%E2%80%93Hellman Elliptic curve Diffie–Hellm ...
Hashing to elliptic curve算法改进
1. 引言前序博客有: ECDSA VS Schnorr signature VS BLS signature 第3节"BLS签名" 私钥pkpkpk,对应的公钥为P=pk×GP ...
Emacs: Failed to verify signature archive-contents.sig或gpg: 无法检查签名：没有公钥
背景我在Ubuntu18.04上安装emacs使用,不过并不是最新版的emacs,版本号25.2.2.我本安装一个软件包company,用来自动补全.但是找遍了提供的软件包,也没有发现有,而且软件包 ...
Elliptic Curve Cryptography (ECC) and Pairings 椭圆曲线密码学与配对
本文是Dan Boneh 和Victor Shoup所写书籍A Graduate Course in Applied Cryptography的笔记. The group of points of a ...
椭圆曲线加密（Elliptic Curve Cryptography, ECC）
近年来,国内外的科研人员面向设备资源受到限制的多种场景提出了很多基于ECC的认证密钥协商协议.虽然各协议应用场景不尽相同,但解决的问题和最终的目标都较为类似,可以归纳为在性能开销尽可能小的前提下,安全 ...

elliptic-curve签名验证verify signature in EdDSA

1. signature in EdDSA

elliptic-curve签名验证verify signature in EdDSA相关推荐

最新文章

热门文章