Is it safe to use same private key in two or more EC signature algorithms? Given two (or more) algorithms:


ed25519


private key is random blob of 32 bytes
public key is encoded point on Edwards 25519 curve.

ECDSA with secp256k1


private key is random blob of 32 bytes
public key is encoded point on secp256k1 curve.



Lets say, we have a message M and we sign it with both algorithms, with the same private key (public keys are calculated deterministically based on private key). Adversary is able to see both signatures, collect history of such signatures for different messages, messages are unencrypted.

Are there any security implications for this scheme?
In general, using the same key in different algorithms is bad practice, and indeed having two public keys on different curves with the same private key could reveal information. I don't know how, but I am sure that you cannot prove a reduction from one to another (unless you can map one group to another, which is doubtful).

Having said the above, if you use the same curve, but just different algorithms for signing, then I believe that one could prove security (but I won't do all the details). This is because EdDSA is actually a Schnorr signature, and so it is a zero-knowledge proof of knowledge of the secret key, secure in the random oracle model. Thus, one could proof that if you can break ECDSA given ECDSA and EdDSA signing oracles, then you could break ECDSA given only an ECDSA signing oracle (by simulating the EdDSA signing oracle yourself in the random oracle model). Thus, if ECDSA is secure then using the same key for Schnorr doesn't harm anything.