1

I'm using elliptic curve cryptography (curve25519 and ed25519) for key exchange and signing. The signing and key exchange keypairs are independent. I need two users to be able to verify each other's identity using their permanent ed25519 keys. One solution I came up with was to have each user generate a nonce, have the opposite user sign the nonce, and then we can verify the signature. The problem with this is that a malicious user may generate a nonce that reads "revoke this key" or something a user doesn't want to sign.

The second proposed solution is to have each user generate an ephemeral curve25519 exchange key that will only be used for this verification. We then have both users compute a shared secret, hash the shared secret, and sign the hash. This way, each user will most likely be signing some garbage data. Is this method of verification secure, and what is the accepted way of verifying someone owns a signing key?

  • 1
    No, since they're still standardly signing something. Just use a single-bit (or single-byte) prefix to indicate whether or not what they're signing is supposed to be only a nonce. – user49075 Sep 9 '14 at 22:17
  • I'm not sure I understand. – tomKPZ Sep 9 '14 at 22:23
  • ... which of my two sentences? – user49075 Sep 9 '14 at 22:23
  • I think I get what you're saying now. With this single bit, it would be implicitly understood by everyone that the signing data is only a nonce. So instead of signing "revoke this certificate", we would be explicitly signing, "nonce: revoke this certificate", and everyone would know that the user doesn't really want to revoke their own certificate. Although I suppose I still don't understand why standardly signing something would be an issue. – tomKPZ Sep 9 '14 at 22:30
  • I think Ricky is pointing out that signing the shared secret hash is no different than signing a nonce. His suggestion is to build into your protocol some sort of flag that indicates that it is strictly for verification purposes. – RoraΖ Sep 10 '14 at 11:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.