3 ms·

> EdDSA is not fundamentally more sidechannel resistant; sidechannel resistance is a function of the implementation. > ... > It would be more accurate to say th

> EdDSA is not fundamentally more sidechannel resistant; sidechannel resistance is a function of the implementation. > ... > It would be more accurate to say that so far EdDSA has had a more conscientious implementation culture around it. Your assessment is correct. EdDSA is deterministic which eliminates the nonce-reuse concerns, but deterministic EdDSA/ECDSA requires side-channel resistance. I erred in my previous comment.

nullc 11y ago
Right. One can easily implement EdDSA without deterministic nonce generation or with insecure nonce generation (it would be an error to call it EdDSA: but no verifier could tell; and if the signature is accepted that is EdDSA-enough for people to call it that in practice); likewise one could implement ECDSA with deterministic nonce generation (e.g. as specified in RFC6979). It's not hard to find examples of both.