A deterministic signature avoids fresh randomness for every signing operation. Instead, signing derives the required per-signature nonce from secret data and the message, making the signing process reproducible without treating randomness generation as a separate input. section 7.3.4
EdDSA illustrates the technique through these components:
- Derives an actual signing key and a separate nonce key from the secret key. section 7.3.4
- Uses the nonce key and message to deterministically generate the nonce for each signature. section 7.3.4
- Appears in practice primarily as Ed25519, while Ed448 provides the alternative Edwards448 instantiation. section 7.3.4
Figure 7.11 EdDSA key generation produces a secret key that is then used to derive two other keys. The first derived key is the actual signing key and can thus be used to derive the public key; the other derived key is the nonce key, used to deterministically derive the nonce during signing operations. EdDSA signatures are then like Schnorr signatures with the exception that (1) the nonce is generated deterministically from the nonce key and the message, and (2) the public key of the signer is included as part of the challenge.
Trace how EdDSA derives signing and nonce keys, then uses the nonce key and message during signing. section 7.3.4
