2

If ed25519 is that attractive that it seems to be, can someone explain why adoption has been slow and if there are, if any, challenges with implementing ed25519.

Nathan Aw

Nathan Aw
  • 2,277
  • 3
  • 17
  • 21

2 Answers2

4

In general, assumptions that have been around for a long time are considered far preferable to new ones. Although a new curve is not strictly a new assumption, these curves do have special structure and so may contain surprises. This is not to say that they do contain surprises, and indeed they are not vulnerable to any KNOWN attacks (but that is only what is known). Also, note that EdDSA may be less side-channel resistant than expected, as shown in Daniel Genkin's talk at RWC 2018.

Yehuda Lindell
  • 27,820
  • 1
  • 66
  • 83
1

Most CAs are business-oriented, meaning their certificate issuing software system are written under bureaucratic forces - the result of this type of software development, is that update to products often take years if not decades to occur.

So when the non-techy shareholders sitting around board table, the last thing they can understand is the advantageous properties of EdDSA such as misuse-resistant, side-channel safe, etc. No wonder why they can't move forward to invest in that.

DannyNiu
  • 9,207
  • 2
  • 24
  • 57
  • 1
    Note that, in PKI, you have a significant chicken/egg problem; CA's won't issue EdDSA certs unless all the clients needing to accept the certs will understand them, and the people writing the clients won't bother supporting those certs unless there's actually some in the field. There are some ways around this particular chicken/egg; however it still takes a while... – poncho Mar 08 '18 at 18:37