2 ms·
Actually, Ed25519 is the Edwards curve isomorphic to Curve25519 (which IIRC is a Montgomery curve). Edwards is faster than Montgomery for signature, but not sig
by a1369209993 8y ago
Actually, Ed25519 is the Edwards curve isomorphic to Curve25519 (which IIRC is a Montgomery curve).
Edwards is faster than Montgomery for signature, but not significantly slower for key agreement.
You can use it for ECDH, and unless I've missed some non-obvious attack (which is of course, entirely possible) you probably should, since that allows you to use (mostly) the same elliptic curve math primitives for key agreement as for signature.
(That is, you should use Edwards form points as shared-secret output. It's possible to implement Curve25519 using Ed25519 internally, but probably not a good idea.)
- tptacek 8y agoMy understanding is that Ed25519 is birational to Curve25519, not actually isomorphic, but also that the difference between the two ("almost" vs "perfectly" isomorphic) is not really all that interesting. I thought Ed25519 was better for multiple-base operations used in signing, but slower for variable-base operations in ECDH.
- a1369209993 8y ago> that Ed25519 is birational to Curve25519, not actually isomorphic That might be the case, I only meant isomorphic in the programming sense of f(x) = h⁻¹(g(h(x))) for relatively trivial h. > I thought Ed25519 was [...] slower for variable-base operations in ECDH. My understanding is that Ed25519 requires replacing several of Curve25519's field squarings with general multiplications, but isn't actually any slower if you use a general multiply for everything. I'm not sure how much optimization you can get out of squaring though, so it might be a easy 10% bonus you're passing up there.