DLOG ⇒ EdDSA

Fully-black-box reduction · random oracle model · BCJZ21

Statement

With the hash modeled as a random oracle, EdDSA, including its Ed25519 instantiations, is EUF-CMA secure if DLOG is hard in the prime-order subgroup of the twisted Edwards curve generated by the base point — BCJZ21. BCJZ21 also analyse strong unforgeability and resilience against key substitution for the standardized and deployed Ed25519 variants, which differ in subtle ways — BCJZ21.

Notes

• EdDSA differs from Schnorr signatures in hashing the public key with the commitment and in deriving the nonce deterministically from the secret key and the message — BDLSY11.