ASKSAGE: Sage Q&A Forum - Individual question feedhttp://ask.sagemath.org/questions/Q&A Forum for SageenCopyright Sage, 2010. Some rights reserved under creative commons license.Tue, 20 Feb 2018 05:56:14 -0600ed25519 elliptic curvehttp://ask.sagemath.org/question/41187/ed25519-elliptic-curve/Is is possible to represent the elliptic curve used by the ed25519 signature scheme in Sage? How?
EllipticCurve takes parameters for the long Weierstrass form of an Elliptic curve. But I don't know how to convert the ed25519 curve to that form, if it even is possible.
Mon, 19 Feb 2018 14:48:55 -0600http://ask.sagemath.org/question/41187/ed25519-elliptic-curve/Answer by Travis for <p>Is is possible to represent the elliptic curve used by the ed25519 signature scheme in Sage? How?</p>
<p>EllipticCurve takes parameters for the long Weierstrass form of an Elliptic curve. But I don't know how to convert the ed25519 curve to that form, if it even is possible.</p>
http://ask.sagemath.org/question/41187/ed25519-elliptic-curve/?answer=41196#post-id-41196Did you mean Curve25519? It looks like the standard way to write Curve 25519 is already in long Weirstrass form (see the wiki site: wikipedia.org/wiki/Curve25519). In Sage we can build this as:
```
E = EllipticCurve(GF(2^255-19),[0,486662,0,1,0])
```
I verified that the trace matched that listed on the safecurves site. Namely,
```
E.trace_of_frobenius() == -221938542218978828286815502327069187962
```
The curve used in the signature scheme Ed25519 (as explained on wikipedia.org/wiki/EdDSA#Ed25519 ), is birationaly equivalent to Curve25519, which is what we constructed above. A change of variables is given in the wikipedia entry.
I hope this helps,
Travis
Mon, 19 Feb 2018 22:37:28 -0600http://ask.sagemath.org/question/41187/ed25519-elliptic-curve/?answer=41196#post-id-41196Comment by Frans Lundberg for <p>Did you mean Curve25519? It looks like the standard way to write Curve 25519 is already in long Weirstrass form (see the wiki site: wikipedia.org/wiki/Curve25519). In Sage we can build this as:</p>
<p><code>
E = EllipticCurve(GF(2^255-19),[0,486662,0,1,0])
</code></p>
<p>I verified that the trace matched that listed on the safecurves site. Namely,</p>
<p><code>
E.trace_of_frobenius() == -221938542218978828286815502327069187962
</code></p>
<p>The curve used in the signature scheme Ed25519 (as explained on wikipedia.org/wiki/EdDSA#Ed25519 ), is birationaly equivalent to Curve25519, which is what we constructed above. A change of variables is given in the wikipedia entry.</p>
<p>I hope this helps,</p>
<p>Travis</p>
http://ask.sagemath.org/question/41187/ed25519-elliptic-curve/?comment=41198#post-id-41198>Did you mean Curve25519?
No. I mean the curve used by ed25519 signature scheme. It is birationally equivalent to E = EllipticCurve(GF(2^255-19),[0,486662,0,1,0]), but I wish to define a Sage EllipticCurve for the ed25519 curve:
-x^2 + y^2 = 1 - (121665/121666) x^2 y^2
I wish I could express, for example, Diffie-Hellman, with simple Sage code like:
E = EllipticCurve(???)
P = ... base point...
a, b = random field elements
A = a*P
B = b*P
a*B == b*A # Returns True
I would like to experiment with ed25519 signatures, including distributed signing. I need Sage to generate the correct test data.
I suppose I could convert coordinates in x15519 to ed25519 coordinates as Travis says. However, I don't want to loose nice Sage syntax.Tue, 20 Feb 2018 05:56:14 -0600http://ask.sagemath.org/question/41187/ed25519-elliptic-curve/?comment=41198#post-id-41198