{"action":"created","issue":{"url":"https://api.github.com/repos/orlp/ed25519/issues/3","labels_url":"https://api.github.com/repos/orlp/ed25519/issues/3/labels{/name}","comments_url":"https://api.github.com/repos/orlp/ed25519/issues/3/comments","events_url":"https://api.github.com/repos/orlp/ed25519/issues/3/events","html_url":"https://github.com/orlp/ed25519/issues/3","id":77212679,"number":3,"title":"key recovery from protocols using ed25519_add_scalar","user":{"login":"MentalCollatz","id":8856947,"avatar_url":"https://avatars.githubusercontent.com/u/8856947?v=3","gravatar_id":"","url":"https://api.github.com/users/MentalCollatz","html_url":"https://github.com/MentalCollatz","followers_url":"https://api.github.com/users/MentalCollatz/followers","following_url":"https://api.github.com/users/MentalCollatz/following{/other_user}","gists_url":"https://api.github.com/users/MentalCollatz/gists{/gist_id}","starred_url":"https://api.github.com/users/MentalCollatz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MentalCollatz/subscriptions","organizations_url":"https://api.github.com/users/MentalCollatz/orgs","repos_url":"https://api.github.com/users/MentalCollatz/repos","events_url":"https://api.github.com/users/MentalCollatz/events{/privacy}","received_events_url":"https://api.github.com/users/MentalCollatz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-05-17T04:39:18Z","updated_at":"2015-06-03T10:29:59Z","closed_at":null,"body":"Consider the following protocol:\r\n\r\nAlice has a private key **a** with corresponding public key **A**.\r\nAlice and Bob perform some protocol to derive a scalar **t**, from which they derive a new keypair (**a'**, **A'**) using `ed25519_add_scalar`.\r\nNow Bob gets Alice to sign the same message twice - once using **A** and once using **A'**.  Denote (**R**, **S**) and (**R'**, **S'**) as the respective signatures.\r\n\r\nSimple enough, right?  However, note that `ed25519_add_scalar` does not modify the second half of the key (the one used to generate **R**), so **R**=**R'**. Bob can therefore recover Alice's private key using:\r\n\r\na = (S - S' + t*H(R,A',M)) / (H(R,A,M)-H(R,A',M))\r\n\r\nI have implemented a proof-of-concept that confirms it works in practice.\r\n\r\nMy recommendation is that `ed25519_add_scalar` should replace private_key[32:64] with Hash(private_key[32:64], scalar)."},"comment":{"url":"https://api.github.com/repos/orlp/ed25519/issues/comments/108291326","html_url":"https://github.com/orlp/ed25519/issues/3#issuecomment-108291326","issue_url":"https://api.github.com/repos/orlp/ed25519/issues/3","id":108291326,"user":{"login":"Codewyvern","id":5712645,"avatar_url":"https://avatars.githubusercontent.com/u/5712645?v=3","gravatar_id":"","url":"https://api.github.com/users/Codewyvern","html_url":"https://github.com/Codewyvern","followers_url":"https://api.github.com/users/Codewyvern/followers","following_url":"https://api.github.com/users/Codewyvern/following{/other_user}","gists_url":"https://api.github.com/users/Codewyvern/gists{/gist_id}","starred_url":"https://api.github.com/users/Codewyvern/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Codewyvern/subscriptions","organizations_url":"https://api.github.com/users/Codewyvern/orgs","repos_url":"https://api.github.com/users/Codewyvern/repos","events_url":"https://api.github.com/users/Codewyvern/events{/privacy}","received_events_url":"https://api.github.com/users/Codewyvern/received_events","type":"User","site_admin":false},"created_at":"2015-06-03T10:29:59Z","updated_at":"2015-06-03T10:29:59Z","body":"Please submit one :) this indeed sounds like a serious issue."}}