> Date: Mon, 27 Mar 2017 11:04:40 -0700 > From: Oleg Andreev <olega...@gmail.com> > > I have a lame question, though. You mention that `a*B = a'*B` holds > for the base point. But is it also true for any point in the B's > subgroup? The reason I ask is that I need to have not just regular > EdDSA signatures, but also DLEQs (discrete log equality proofs) with > random generator points.
Yes. Proof: If P is a point in B's subgroup, then P = p*B for some scalar p. Thus a*P = a*p*B = p*a*B = p*a'*B = a'*p*B = a'*P, since multiplication of scalars is associative with multiplication of curve points, and multiplication of scalars is commutative. _______________________________________________ Curves mailing list Curves@moderncrypto.org https://moderncrypto.org/mailman/listinfo/curves