A nonce key is secret EdDSA-derived material that deterministically produces the temporary nonce used for each signature. It keeps nonce generation tied to the message instead of relying on fresh randomness. section 7.3.4
EdDSA signing uses the nonce key in a short sequence:
- Hash the nonce key together with the message to derive the nonce. section 7.3.4
- Use the nonce to compute commitment R, then combine the challenge and signing key to produce S. section 7.3.4
- Different messages receive different nonces, while signing the same message again deterministically repeats the nonce and signature. section 7.3.4
Why deterministic generation helps
A signer computes HASH(nonce key || message). This avoids accidental nonce reuse across different messages, a failure that can leak a signing key in schemes such as ECDSA. section 7.3.4
Figure 7.11 EdDSA key generation produces a secret key that is then used to derive two other keys. The first derived key is the actual signing key and can thus be used to derive the public key; the other derived key is the nonce key, used to deterministically derive the nonce during signing operations. EdDSA signatures are then like Schnorr signatures with the exception that (1) the nonce is generated deterministically from the nonce key and the message, and (2) the public key of the signer is included as part of the challenge.
Trace how EdDSA derives the signing key and nonce key, then uses the nonce key during signature generation. section 7.3.4
