Cofactor Explained: Clearing Elliptic Curves' dirty little secret
tl;dr: the conclusion of the EdDSA part of the article is wrong. EdDSA has its problems, but malleability is not one of them, if one is following RFC 8032.<p>&gt;There are several ways to sign a document with EdDSA, and produce a valid signature. The three sources of malleability are:<p>&gt;We can add a multiple of L (the order of the prime subgroup) to s. Recall that B has order L as well, so it will absorb any cofactor. Basically everything happens modulo L, so adding L won&#x27;t change a thing.<p>This is prevented in RFC 8032 by checking that 0 &lt;= s &lt; L. Tink [1] does this check, and therefore is malleability free.<p>&gt;We can sign the same message with a different nonce r. This requires knowledge of the secret key a.<p>This proves that the signature of a message is not unique -- that is the signer can product multiple signatures -- but I haven&#x27;t seen anyone calling this a malleability issue. Malleability is about taking a triple (public key, signature message) and tweaking bits to produce another valid triple.<p>&gt;We can add a low order point to A, and subtract it from R. That way we produce a valid signature, but from a public key nobody vouches for. If the verifier checks the weaker equation, we can add a low order point to just R, and produce a &quot;valid&quot; signature with the same public key.<p>This is the second time I saw this claim. When I first saw it [2], I thought, wait, this test is missing in Wycheproof [3], but Bleichenbacher does NOT miss anything. That&#x27;s when I knew it&#x27;s wrong.<p>Modifying A or R instantly makes the signature invalid. Using the article&#x27;s notation, the signature is validated by checking that<p>B.s.8 == R.8 + A.h.8, where h = SHA-512(R, A, M) and M is the message<p>Multiplying the cofactor or not doesn&#x27;t matter, doesn&#x27;t introduce any weakness, as implied by the article. If R or A is changed, h will change.<p>[1] <a href="https:&#x2F;&#x2F;github.com&#x2F;google&#x2F;tink" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;google&#x2F;tink</a><p>[2] <a href="https:&#x2F;&#x2F;github.com&#x2F;dalek-cryptography&#x2F;ed25519-dalek&#x2F;issues&#x2F;20" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;dalek-cryptography&#x2F;ed25519-dalek&#x2F;issues&#x2F;2...</a><p>[3] <a href="https:&#x2F;&#x2F;github.com&#x2F;google&#x2F;wycheproof" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;google&#x2F;wycheproof</a>. Wycheproof has tests for EdDSA malleability, but it only tests if s is not properly range checked.