Skip to content

changes for the ed25519 verification algorithm #60

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
algofoundation merged 4 commits into from
Feb 1, 2022
Merged

changes for the ed25519 verification algorithm #60

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
33686ba
changes for the ed25519 verification algorithm
Jan 13, 2022
851e692
add more details on the ed25519 changes.
Jan 18, 2022
59921bb
CR fix
Jan 23, 2022
ac25d1b
Merge branch 'master' into ed25519-changes
algofoundation Feb 1, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions dev/crypto.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,6 +95,38 @@ random seed.
Algorand uses the [ed25519][ed25519] digital signature scheme to sign
data.

Algorand changes the ed25519 verification algorithm in the following way (using notation from [ed25519][ed25519]):
- Reject if R or A (PK) are equal to one of the following (non-canonical encoding - this check is actually required by [ed25519][ed25519] but not all libraries implement it)
- `0100000000000000000000000000000000000000000000000000000000000080`
- `ECFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF`
- `EEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7F`
- `EEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF`
- `EDFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF`
- `EDFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7F`
- a point which holds `(x,y) where: 2**255 -19 <= y <= 2**255.` Where we remind that y is defined as the encoding of the point with the right-most bit cleared

- Reject if A (PK) is equal to one of the following: (small order points)
- `0100000000000000000000000000000000000000000000000000000000000000`
- `ECFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7F`
- `0000000000000000000000000000000000000000000000000000000000000080`
- `0000000000000000000000000000000000000000000000000000000000000000`
- `C7176A703D4DD84FBA3C0B760D10670F2A2053FA2C39CCC64EC7FD7792AC037A`
- `C7176A703D4DD84FBA3C0B760D10670F2A2053FA2C39CCC64EC7FD7792AC03FA`
- `26E8958FC2B227B045C3F489F2EF98F0D5DFAC05D3C63339B13802886D53FC05`
- `26E8958FC2B227B045C3F489F2EF98F0D5DFAC05D3C63339B13802886D53FC85`


- Reject non-canonical S (this check is actually required by [ed25519][ed25519] but not all libraries implement it)<br>
```
0 <= s < L
(where
L = 2^252+27742317777372353535851937790883648493)
```
- Use the cofactor equation (this is the default verification equation in [ed25519][ed25519]):<br>
```
[8][S]B = [8]R + [8][K]A'
```


### Ephemeral-key Signature

Expand Down