Ed25519 vs ECDSA: Why the Nonce Decides Everything
ECDSA and Ed25519 both sign data with elliptic curves, and both produce a 64-byte signature that verifies in a fraction of a millisecond. The difference between them is almost invisible on paper: ECDSA needs a fresh secret random number for every signature, and Ed25519 computes that number instead. That one design choice is the reason real people have lost real private keys. A digital signature…
ECDSA and Ed25519 both utilize elliptic curves to sign data, with signatures being 64 bytes in length and verifying quickly. The primary distinction lies in their approaches to nonce generation. ECDSA requires a unique random number (k) for every signature, while Ed25519 computes this automatically. This design decision has severe consequences, as demonstrated by two prominent key-recovery incidents.
In 2010, Sony's PlayStation 3 firmware was signed using ECDSA with a constant nonce, allowing the private key to be recovered from two signed messages. Similarly, in 2013, a flaw in Android's SecureRandom implementation led to ECDSA key exposure, resulting in Bitcoin thefts from affected wallets. The critical factor is that ECDSA's nonce must remain unique and unpredictable for each signature; otherwise, the scheme is compromised.
Two strategies have emerged to address this issue: deterministic ECDSA (RFC 6979) and Ed25519. Deterministic ECDSA derives the nonce using an HMAC construction, eliminating RNG dependency and ensuring key protection. Alternatively, Ed25519 adopts a design where the nonce is deterministic from the beginning, based on hashing the private key material and message using SHA-512.
This eliminates the need for a random nonce altogether. Ed25519 also boasts additional advantages, such as inherent resistance to side-channel attacks due to its complete addition formulas and non-malleable signature encoding. However, ECDSA persists due to legacy infrastructure and its early adoption, with NIST standardizing certain elliptic curves before Ed25519's emergence.
Despite this, understanding the significance of nonce generation is crucial to ensuring the security of digital signatures.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
