[curves] Optimizing a pair of EdDSA signatures on the same message

[Jeff Burdges]

Appears I failed to CC the list, but Ben resolved this.

On Mon, 2015-11-09 at 11:17 +1100, Ben Harris wrote:
> On 9 Nov 2015 10:46 am, "Jeff Burdges" <burdges at gnunet.org> wrote:
> >
> > My friend Joe asked me about optimizing a pair of Ed25519
> signatures on
> > the same message with both a long-term session key x and a short
> -term
> > session key y.
> > (R_y,S_y,S_x) that takes only 96 bytes instead of the 128 bytes of
> > doing two separate signatures.
> >
> Could you just send the short term key as an implicit (EQCV) issued
> by the long term which is only 32 bytes? Then the message signed by
> the session key is an additional 64 bytes giving your 96 byte total.

Yes, I believe that works well for his use case.  Actually it's simpler
than ECQV since Alice controls both keys.

Thank you!
Jeff

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: This is a digitally signed message part
URL: <http://moderncrypto.org/mail-archive/curves/attachments/20151109/0a75315b/attachment.sig>