EIPs/EIPS/eip-665.md

eip	title	author	status	type	category	created
665	Add precompiled contract for Ed25519 signature verification	Tobias Oberstein <tobias.oberstein@crossbario.com>	Draft	Standards Track	Core	2018-03-25

Simple Summary

Support performant and cheap verification of Ed25519 cryptographic signatures in smart contracts in general by adding a precompiled contract for Ed25519 signature verification to the EVM.

Abstract

Verification of Ed25519 cryptographic signatures is obviously possible in EVM bytecode. However, the gas cost will be very high, and computationally expensive, as such tight, wide word operations intensive code as required for Ed25519 is not a good fit for the EVM bytecode model.

The addition of a native compiled function, in a precompiled contract, to the EVM solves both cost and performance problems.

Motivation

One motivation for Ed25519 signature verification in smart contracts is to associate existing off-chain systems, records or accounts that use Ed25519 with blockchain transactions.

Another motivation is the processing of external, Ed25519 proof-of-stake based blockchains within Ethereum smart contracts.

When a transactions contains data that comes with an Ed25519 signature, that proves that the sender of the Ethereum transaction was also in control of the private key (and the data), and this allows the contract to establish an association between the blockchain and the external system or account, and the external system establish the reverse relation.

For example, a contract might check a Ed25519 signed piece of data submitted to the Ethereum transaction like the current block number. That proves to the contract, that the sender is in possession of both the Ethereum private key and the Ed25518 private key, and hence the contract will accept an association between both. This again can be the root anchor for various powerful applications, as now a potentially crypto holding key owner has proven to be in control of some external off-chain system or account, like e.g. a DNS server, a DNS domain, a cluster node and so on.

Specification

If block.number >= CONSTANTINOPLE_FORK_BLKNUM, add a precompiled contract for Ed25519 signature verification (ED25519VFY).

The proposal adds a new precompiled function ED25519VFY with the following input and output.

ED25519VFY takes as input 128 bytes:

1. message: The 32-byte message that was signed
2. public key: The 32-byte Ed25519 public key of the signer
3. signature: The 64-byte Ed25519 signature

ED25519VFY returns as output 1 byte:

1. result: 0x00 if signature is valid, else invalid signature

Address

The address of ED25519VFY is 0x8.

Gas costs

Gas cost for ED25519VFY is 2000.

Rationale

The proposed ED25519VFY function takes the signer public key as a call parameter, as with Ed25519, I don't believe it is possible to derive the signers public key from the signature and message alone.

The proposed ED25519VFY function uses a zero return value to indicate success, since this allows for different errors to be distinguished by return value, as all non-zero return values signal a verification failure.

ECRECOVER has a gas cost of 3000. Since Ed25519 is computationally cheaper, the gas price should be less.

Backwards Compatibility

As the proposed precompiled contract is deployed at a reserved (<255) and previously unused address, an implementation of the proposal should not introduce any backward compatibility issues.

Test Cases

Test vectors for Ed25519 can be found in this IETF ID https://tools.ietf.org/html/draft-josefsson-eddsa-ed25519-03#section-6.

More test vectors can be found in the regression tests of NaCl (see references).

Implementation

NaCl is a high-quality implementation of Ed25519, available from the same team that created the algorithms and cryptography behind Ed25519.

The library should allow implementations of the proposed ed25519verify function with few lines of code in the hosting Ethereum implementation.

References

• Definition of Ed25519: https://ed25519.cr.yp.to/ed25519-20110926.pdf
• Ed25519 - high-speed high-security signatures: https://ed25519.cr.yp.to/
• NaCl - Networking and Cryptography library: https://nacl.cr.yp.to/sign.html
• NaCl Crypto Libraries (which contains Ed25519): https://ianix.com/pub/ed25519-deployment.html
• Test vectors for Ed25519: https://tools.ietf.org/html/draft-josefsson-eddsa-ed25519-03#section-6
• NaCl regression tests: https://ed25519.cr.yp.to/python/sign.py and https://ed25519.cr.yp.to/python/sign.input
• On the recoverability of public keys from signature+message (alone): https://crypto.stackexchange.com/questions/9936/what-signature-schemes-allow-recovering-the-public-key-from-a-signature

Copyright

Copyright and related rights waived via CC0.