one ecc key-pair for both encryption and signature?

Andrew Gallagher andrewg at
Fri Jan 7 18:26:17 CET 2022

On 07/01/2022 16:55, Bernhard Reiter wrote:
> > Then RSA should be limited in the same way.
> (Because there it is possible, so I guess that there is another reason.)

I agree, although IIRC such usage is supported for backwards 
compatibility reasons.

> | The curve is birationally equivalent to a twisted Edwards curve
> | used in the Ed25519 signature scheme.
> There is anequivalence given (two functions) in the Ed25519 wikipedia page,
> but I don't know if this allows the same curve used in both algorithms.

"Birationally equivalent" means that there is a 1:1 mapping between the 
points of each curve that preserves their mathematical structure. This 
means that you could in principle convert a key from one curve to the 
other, but it would be a more complex function than just copying the raw 
bit string.

Andrew Gallagher

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <>

More information about the Gnupg-users mailing list