<p>Yes, Ed25519 provides the existential unforgeability property. There is a nice work that studies the different variants of Ed25519 signatures</p>
<p><a href="https://eprint.iacr.org/2020/823.pdf" rel="nofollow noreferrer">https://eprint.iacr.org/2020/823.pdf</a></p>
<p>As specified in that document, the different variants of ed25519 provide different security properties, but all are existentially unforgeable under chosen message attacks.</p>
<p>Indeed, as you point out, if an adversary could forge valid signatures to messages not signed by the key owner, the security of the blockchain could be compromised.</p>

CC BY-SA 4.0
2022-03-25T10:22:54.703Z
Thank you for that paper! Its quite a "recent" paper and as it states in the abstract "no detailed proofs have ever been given for these security properties for EdDSA". I am glad that these security proofs are given just before shelley was launched :)
Fermat
CC BY-SA 4.0
2022-03-25T10:13:23.743Z
2022-03-25T10:13:23.743Z
azinig
<p>Is the signature scheme of shelley (Ed25519) is EUF-CMA secure?  The <strong>E</strong>xistential <strong>U</strong>n<strong>f</strong>orgeability under <strong>C</strong>hosen <strong>M</strong>essage <strong>A</strong>ttack experiment works like this:</p>
<ol>
<li><p>The challenger generates a valid keypair (pk, sk) and gives pk to the attacker.</p>
</li>
<li><p>The attacker may now repeatedly ask for signatures on chosen messages $(M_1, \dots, M_q)$ of its choosing, and receives the valid signatures $(\sigma_1, \dots, \sigma_q)$ in response.</p>
</li>
<li><p>At the conclusion of the experiment, the attacker must output a message and signature $M^<em>$, $\sigma^</em>$ such that (1) the message $M^*$ was not one of the messages requested in the previous step, and (2) the message/signature verifies correctly under the public key <a href="https://blog.cryptographyengineering.com/euf-cma-and-suf-cma/" rel="nofollow noreferrer">(Ref)</a>.</p>
</li>
</ol>
<p>Now I guess the used signature scheme by Shelley is EUF-CMA secure since by assuming the contrary it would break the blockchain?</p>
<hr />
<p><strong>EDIT</strong></p>
<p>The only problem I see with assuming the contraposition of the statement is that the messages $(M_1,\dots, M_q)$ are chosen by the adversary. This is not the case in a public ledger though it could be extracted?</p>

<ledger><shelley><cryptography>
Is Ed25519 is EUF-CMA secure?
# Is Ed25519 is EUF-CMA secure?

(Asked by: username_0 on 2022-03-25)

Is the signature scheme of shelley (Ed25519) is EUF-CMA secure? The **E**xistential **U**n**f**orgeability under **C**hosen **M**essage **A**ttack experiment works like this:

1. The challenger generates a valid keypair (pk, sk) and gives pk to the attacker.
2. The attacker may now repeatedly ask for signatures on chosen messages $(M\_1, \dots, M\_q)$ of its choosing, and receives the valid signatures $(\sigma\_1, \dots, \sigma\_q)$ in response.
3. At the conclusion of the experiment, the attacker must output a message and signature $M^*$, $\sigma^*$ such that (1) the message $M^\*$ was not one of the messages requested in the previous step, and (2) the message/signature verifies correctly under the public key [(Ref)](https://blog.cryptographyengineering.com/euf-cma-and-suf-cma/).

Now I guess the used signature scheme by Shelley is EUF-CMA secure since by assuming the contrary it would break the blockchain?

---

**EDIT**

The only problem I see with assuming the contraposition of the statement is that the messages $(M\_1,\dots, M\_q)$ are chosen by the adversary. This is not the case in a public ledger though it could be extracted?

**Tags:** ledger, shelley, cryptography

---

## 1 answers

### Answer by username_1 on 2022-03-25. Score: 1

Yes, Ed25519 provides the existential unforgeability property. There is a nice work that studies the different variants of Ed25519 signatures

<https://eprint.iacr.org/2020/823.pdf>

As specified in that document, the different variants of ed25519 provide different security properties, but all are existentially unforgeable under chosen message attacks.

Indeed, as you point out, if an adversary could forge valid signatures to messages not signed by the key owner, the security of the blockchain could be compromised.

> **Comments:**
> **username_0**: Thank you for that paper! Its quite a "recent" paper and as it states in the abstract "no detailed proofs have ever been given for these security properties for EdDSA". I am glad that these security proofs are given just before shelley was launched :)  

---

