Subject: [Cfrg] Ed25519 - X25519 keypair equivalences

From: Robert Moskowitz <[email-masked]>
Date: Fri, 5 Jun 2020 13:54:11 -0400

I am trying to understand rfc7748 sec 4.1 last paragraph:

    The Montgomery curve defined here is equal to the one defined in
    [curve25519], and the equivalent twisted Edwards curve is equal to
    the one defined in [ed25519].

It seems that if I have an Ed25519 key in an X.509 certificate, I can 
use that equally for an EdDSA signature and an ECDH key derivation.

Are there limits on this?  Like a particular group of keypairs (like 
what parameters).

Are there crypto risks/attacks if 2 keypairs are used between two 
entities both for signing (Ed25519) and encryption (via X25519)?

This is potentially powerful...

thanks

---

From: chris - <[email-masked]>
Date: Fri, 5 Jun 2020 14:35:17 -0400

Hi Robert,

Using the same secret for two different applications is not generally
secure. Whether it's secure depends intrinsically on what the applications
are.

Best,
Chris P.

On Fri, Jun 5, 2020 at 1:55 PM Robert Moskowitz <[email-masked]>
wrote:

> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg
>

---

From: Russ Housley <[email-masked]>
Date: Fri, 5 Jun 2020 14:55:06 -0400

>    the one defined in [ed25519].

I think this is talking about different ways to represent the curve in an implementation.  It is not encouraging the use of the same private key for key management and signature.

Russ

---

From: Jim Schaad <[email-masked]>
Date: Fri, 5 Jun 2020 12:01:14 -0700

Bob,

You should look at this document https://datatracker.ietf.org/doc/draft-ietf-lwig-curve-representations/

Jim

-----Original Message-----
From: Cfrg <[email-masked]> On Behalf Of Robert Moskowitz
Sent: Friday, June 5, 2020 10:54 AM
To: [email-masked]
Subject: [Cfrg] Ed25519 - X25519 keypair equivalences

It seems that if I have an Ed25519 key in an X.509 certificate, I can use that equally for an EdDSA signature and an ECDH key derivation.

Are there limits on this?  Like a particular group of keypairs (like what parameters).

Are there crypto risks/attacks if 2 keypairs are used between two entities both for signing (Ed25519) and encryption (via X25519)?

thanks

---

From: "Riad S. Wahby" <[email-masked]>
Date: Fri, 5 Jun 2020 16:48:19 -0700

> secure. Whether it's secure depends intrinsically on what the applications

As luck would have it, Degabriele, Lehmann, Paterson, Smart, and
Strefler (CT-RSA '12, https://eprint.iacr.org/2011/615) show that
ECIES and EC-Schnorr signatures are secure when instantiated with
the same secret key, in the random oracle model and assuming that
gap-DH and gap-DLP are hard (see Theorem 2).

It seems like this proof could be extended to EdDSA and HPKE with
DHKEM---but I haven't done more than glance! so this should be
regarded as a pointer, not a recommendation.

Cheers,

-=rsw