Cryptography Stack Exchange
Cryptography Stack Exchange

Questions tagged [ed448]

In cryptography, Curve448 or Curve448-Goldilocks is an elliptic curve potentially offering 224 bits of security and designed for use with the elliptic-curve Diffie–Hellman (ECDH) key agreement scheme.

In cryptography, Curve448 or Curve448-Goldilocks is an elliptic curve potentially offering 224 bits of security and designed for use with the elliptic-curve Diffie–Hellman (ECDH) key agreement scheme.

Developed by Mike Hamburg of Rambus Cryptography Research, Curve448 allows fast performance compared with other proposed curves with comparable security.

The reference implementation is available under an MIT license.

The curve was favored by the Internet Research Task Force Crypto Forum Research Group (IRTF CFRG) for inclusion in Transport Layer Security (TLS) standards along with Curve25519.

In 2017, NIST announced that Curve25519 and Curve448 would be added to "Special Publication 800-186", which specifies approved elliptic curves for use by the US Federal Government. A 2019 draft of FIPS 186-5 confirms this claim. Both are described in RFC 7748

11 questions
41
votes
2 answers

Elliptic curve ed25519 vs ed448 - Differences

Other than key size, What are some differences between the Elliptic curve ed25519 and ed448?
Nathan Aw
  • 2,357
  • 3
  • 18
  • 22
4
votes
3 answers

Order of Edwards curve and its twist

In Mike Hamburg's Ed448-Goldilocks, a new elliptic curve (eprint 2015, WECCS 2015) it is studied untwisted Edwards curves in the prime field $\mathbb F_p$ $$E_d:\,y^2+x^2\,=\,1+d\,x^2\,y^2$$ with large prime $p\equiv3\pmod 4$ and the Legendre symbol…
fgrieu
  • 149,326
  • 13
  • 324
  • 622
4
votes
2 answers

Ed448 parameters wrong in RFC7748

When implementing and testing my own EdDSA program I found out that the old RFC7748 gives wrong parameters for Ed448/Edwards448. There is currently a new Draft were this is…
Habor
  • 43
  • 2
3
votes
1 answer

Curve448 - Can Ed448 key material be reused for X448?

Currently I am facing a situation in which Ed448 key pairs (private + public key) are available and the system should be extended by a Diffie-Hellman (ECDH) operation. First of let me summarize what I have understand so far. Ed448: Is the digital…
dbog
  • 33
  • 4
3
votes
1 answer

Public key derivation for Ed448

Another potentially silly question here, but I seem to have developed tunnel vision and I am missing something very basic. In RFC 8032 one can find a number of test vectors for Ed488 - for example: SECRET KEY: c4eab05d357007c632f3dbb48489924d …
Jay Smith
  • 71
  • 1
3
votes
1 answer

What is "spinal-tap grade" security?

As stated here Ed448 is different from Ed25519 because of "spinal-tap grade" security. What does this mean?
user1222324562
  • 145
  • 2
2
votes
2 answers

How is the edwards448 generator derived from the curve448 generator in RFC 7748?

In RFC 7748, it is explained how the Montgomery curve, curve448, is deterministically generated from the prime $p = 2^{448} - 2^{224} - 1$. It is also explained how the generator (given below) for curve448 is derived. U(P) 5 V(P) …
user61836
  • 45
  • 6
1
vote
0 answers

Why does EDDSA secret scaler pruning not prevent values >= prime L or zero?

I have been exploring and studying the EDDSA algorithm for curve 25519 and curve 448 in RFC 8032 (https://www.rfc-editor.org/rfc/rfc8032) as well as for curves 414 and 521 from this (https://eprint.iacr.org/2015/677.pdf ) and with respect to the…
cookiecipher
  • 359
  • 1
  • 8
1
vote
1 answer

Performing EdDSA/Ed448 employing Montgomery ladder

EdDSA can be efficiently performed employing the Montgomery ladder. In order to implement this method, the base point should be converted to Mont. space, then the Mont. ladder should be executed, and the $y$-coordinate is required to recover.…
Mojtaba
  • 11
  • 4
1
vote
0 answers

Standard vs. specific mappings in SP800-186 for code reuse between different curve models

The final SP800-186 outlines mappings between Twisted Edwards and Montgomery curves, and between Montgomery and Weierstrass curves. These mappings are defined in Appendix B. Relationships Between Curve Models. There are two types of mappings…
thera
  • 346
  • 2
  • 8
0
votes
1 answer

ed448 generator choice in supercop

Mike Hamburg proposed the Ed448-Goldilocks curve and submitted a software implementation for it to the SUPERCOP project. Below you can see that MH picked a generator (or base point) that has a y-coordinate equal to 19. Why was this generator…
user61836
  • 45
  • 6