一种高效的数字签名算法Ed25519

本文首发公众号VenusBlockChain，关注公众号后可免费阅读！VenusBlockChain致力于区块链技术研究，传播区块链技术和解决方案、区块链应用落地、区块链行业动态等。有兴趣的小伙伴们，欢迎关注。

概要

Ed25519是一个数字签名算法，签名和验证的性能都极高：

• 一个4核2.4GHz 的 Westmere CPU，每秒可以验证 71000 个签名，每秒可以生成109000个签名；
• 安全性极高，等价于RSA约3000-bit；
• 签名过程不依赖随机数生成器，不依赖hash函数的防碰撞性，没有时间通道攻击的问题；
• 签名很小，只有64字节；
• 公私钥也很小，只有32字节。

This paper shows that a $390 mass-market quad-core 2.4GHz Intel Westmere (Xeon E5620) CPU can create 109000 signatures per second and verify 71000 signatures per second on an elliptic curve at a 2^128 security level. Public keys are 32 bytes, and signatures are 64 bytes. These performance figures include strong defenses against software sidechannel attacks: there is no data flow from secret keys to array indices,and there is no data flow from secret keys to branch conditions

11大特点[1]

• Fast single-signature verification. The software takes only 273364 cycles to verify a signature on Intel’s widely deployed Nehalem/Westmere lines of CPUs. (This performance measurement is for short messages; for very long messages, verification time is dominated by hashing time.) Nehalem and Westmere include all Core i7, i5, and i3 CPUs released between 2008 and 2010, and most Xeon CPUs released in the same period.

• Even faster batch verification. The software performs a batch of 64 separate signature verifications (verifying 64 signatures of 64 messages under 64 public keys) in only 8.55 million cycles, i.e., under 134000 cycles per signature. The software fits easily into L1 cache, so contention between cores is negligible: a quad-core 2.4GHz Westmere verifies 71000 signatures per second, while keeping the maximum verification latency below 4 milliseconds.

• Very fast signing. The software takes only 87548 cycles to sign a message. A quad-core 2.4GHz Westmere signs 109000 messages per second.

• Fast key generation. Key generation is almost as fast as signing. There is a slight penalty for key generation to obtain a secure random number from the operating system; /dev/urandom under Linux costs about 6000 cycles.

• High security level. This system has a 2128 security target; breaking it has similar difficulty to breaking NIST P-256, RSA with ~3000-bit keys, strong 128-bit block ciphers, etc. The best attacks known actually cost more than 2140 bit operations on average, and degrade quadratically in success probability as the number of bit operations drops.

• Foolproof session keys. Signatures are generated deterministically; key generation consumes new randomness but new signatures do not. This is not only a speed feature but also a security feature, directly relevant to the recent collapse of the Sony PlayStation 3 security system.

• Collision resilience. Hash-function collisions do not break this system. This adds a layer of defense against the possibility of weakness in the selected hash function.

• No secret array indices. The software never reads or writes data from secret addresses in RAM; the pattern of addresses is completely predictable. The software is therefore immune to cache-timing attacks, hyperthreading attacks, and other side-channel attacks that rely on leakage of addresses through the CPU cache.

• No secret branch conditions. The software never performs conditional branches based on secret data; the pattern of jumps is completely predictable. The software is therefore immune to side-channel attacks that rely on leakage of information through the branch-prediction unit.

• Small signatures. Signatures fit into 64 bytes. These signatures are actually compressed versions of longer signatures; the times for compression and decompression are included in the cycle counts reported above.

• Small keys. Public keys consume only 32 bytes. The times for compression and decompression are again included.

椭圆曲线参数[1]

Ed25519采用的曲线方程为：
$$y^2=x^3+48662x^2+x$$

其中主要参数有：
$b=256$
$q=$