As a beginner, what is a good way to understand the purpose of Program Derived Addresses being bumped off of the ed25519 elliptic curve?
The purpose of being off the curve is so that only the program a PDA is derived from can sign on behalf of the PDA.
It's not that they are being bumped off, it's just that some public key values are on it, and some are off.
From the Public Key class createWithSeed
method's comments:
/**
* Derive a public key from another key, a seed, and a program ID.
* The program ID will also serve as the owner of the public key, giving
* it permission to write data to the account.
*/
Program derived address (PDA) accounts are just non-executable Solana accounts - they have a valid Solana address which looks just like a base58 encoded string of a public key. A key difference (see what I did there?) is that a PDA has no corresponding private key. PDAs being "off the curve" just means that the program a PDA is derived from acts as the owner of the PDA.
How is (the ed25519 elliptic curve) used within Solana to cause PDAs being bumped off of it necessary?
The cryptographic function for finding PDAs is as likely to derive a public key which is on the curve as it is to derive one that's off the curve.
The "bumping" refers the cryptographic strategy of nudging the output to a result which is off the curve. You can see it here in how the nonce
is set to 255
then handled with a decrementing --
operator.
From the findProgramAddressSync
function's comments:
/**
* Find a valid program address
*
* Valid program addresses must fall off the ed25519 curve. This function
* iterates a nonce until it finds one that when combined with the seeds
* results in a valid program address.
*/
There is also, as an example of how the curve positioning is used in Solana, a method on the PublicKey class called, isOnCurve
("Check that a pubkey is on the ed25519 curve") which returns a boolean:
true
i.e. "on the curve" when the account has a corresponding private key
false
i.e. "off the curve" when the account has no private key.
From a support function is_on_curve
, the curve-finding "function and its dependents were sourced from here"
What is the ed25519 elliptic curve?
From the article, "Everything you wanted to know about Elliptic Curve Cryptography"
The basic procedure of ECC is this:
- Choose a curve and a point P on the curve (everyone uses the same point)
- Choose an arbitrary very large number N (this is your private key).
- Using point addition, add P to itself N times
- The x-coordinate of N*P is your public-key
As I understand these things, elliptic curve cryptography is fundamental to "asymmetric encryption" and how we obtain the public and private key pairs we use for digital signatures. The Ed25519 elliptic curve is basically just a particular ECC which uses SHA-512. For more on the naming, see here, but basically it comes from the use of 2^255-19
in Montgomery coordinates:
- "Montgomery coordinates" (X,Y) satisfy Y^2 = X^3 + AX^2 + X mod
2^255-19, where A = 486662.