3

I just found this draft/informal IETF specification: Alternative Elliptic Curve Representation:

This document specifies how to represent Montgomery curves and (twisted) Edwards curves as curves in short-Weierstrass form and illustrates how this can be used to implement elliptic curve computations using existing implementations that already implement, e.g., ECDSA and ECDH using NIST prime curves.

This triggered my curiosity as I thought that ECDSA and EdDSA had many more differences than just different curves.

From what I understand, Edwards curves can be expressed in the Weierstrass form.

How is EdDSA different from using ECDSA with an Edwards curve (e.g., Curve25519) converted to a Weierstrass curve? I am mostly interested in functional aspects rather than possible optimization(s) due to curve parameters.

Related questions: #1, #2

Community
  • 1
DurandA
  • 453
  • 5
  • 22

1 Answers1

7

EdDSA is not ECDSA over a different curve. Rather, it is a type of Schnorr signature. Indeed the name is very confusing, and I'm pretty sure that it was chosen in order to give this impression, since Schnorr is less well known.

Schnorr is essentially a zero-knowledge proof of knowledge of the discrete log of the public key, obtained via the Fiat-Shamir paradigm applied to the classic Schnorr Sigma protocol.

ECDSA is a completely different signature scheme, which was designed specifically to bypass Schnorr's patent (at least, this is the understanding in the field).

Yehuda Lindell
  • 28,270
  • 1
  • 69
  • 86