4

This answer to another question describes the different values chosen as private key and public key by various Ed25516 implementations. What are the advantages / disadvantages of each?

Different Ed25519 private key and signature formats for NaCl, SUPERCOP and python-ed25519

(Table cropped from diagram in the linked answer, originally taken from "How do Ed5519 keys work?" by Brian Warner.)

1 Answers1

3

To perform an Ed25519 signature operation, you need to know three values, denoted by $\sf RH$, $a$ and $A$ in the diagram. Now, as it happens, these values are not independent:

  • $A$ can be derived from $a$, and
  • both $\sf RH$ and $a$ can be derived from the seed $k$.

Thus, all you really need to store is the seed $k$; everything else can be derived from it. Alternatively, it's possible to store $\sf RH$ and $a$ like NaCl does, which saves you the (minor) effort of one SHA-512 hash computation whenever you need to sign something.

There's no particular need to store the public key $A$ as part of the private key, since it can be derived from $a$ and you need to know $a$ anyway to be able to sign. However, deriving $A$ from $a$ requires an elliptic curve multiplication, which is a reasonably expensive operation compared to the other key generation steps. Thus, also storing $A$ as part of the private key provides a modest performance gain compared to storing just $k$ or just $\sf RH$ and $a$.

Ilmari Karonen
  • 46,700
  • 5
  • 112
  • 189