Ed25519 Quirks

As with other digital signature schemes, Ed25519 consists of three protocols: key generation, signing and verification. They are similar, but distinct, from the generic Schnorr scheme.

Key Generation

Ed25519 does not match secret keys to scalars. Instead, a secret scalar is generated from a seed, a 32-byte string, which should be filled at random from a cryptographically secure RNG.

Expanded seed
xseed = Hash(seed) = "rd8o30S9VHVK5XPM+quBML4E0eCQW7hN1m2VbqwN8cGndcko7myO6CXAfcXN2olfY7F72HmYFcGP+l4vw7YhcA=="

The seed is expanded to 64 bytes with the help of a hash function. Most Ed25519 implementations use SHA-512, but any cryptographic hash function with 64-byte output can suffice.

Secret scalar
a = Sc(clamp(xseed[..32])) = Sc("9I9Ra9swCxXxcZVAgMQF3b0E0eCQW7hN1m2VbqwN8QE=")

The first 32 bytes are “clamped” by setting the lower 3 bits and the highest bit (in the LSB interpretation) to 0, and the second-highest bit to 1. The resulting byte sequence is interpreted as a scalar a.

Nonce
nonce = xseed[32..] = "p3XJKO5sjuglwH3FzdqJX2Oxe9h5mBXBj/peL8O2IXA="

The upper 32 bytes of the expanded seed are used as a nonce during signing.

Public key
A = [a]B = Pt("E/9uI9lhUE01vlLtW+02vMqcbImujuoSti53yJC2Z0Y=")

The public key is still (the encoding of) a point on the elliptic curve, obtained by multiplying the basepoint B by the secret scalar.

If you want to know why the secret scalar is clamped in this way, refer to this explanation.

Signing

Signing in Ed25519 is deterministic: it doesn't require an RNG during signing. A faulty RNG during signing can leak the secret key, so this is an understandable design choice.

“Random” scalar
r = Sc(Hash(nonce ‖ M)) = Sc("uCVcejkhHuCaM8+9G66eQtedi2hOTY+AE0Pl+ToFzAY=")

Like in RFC 6979, the “random” scalar r is chosen based on the secret key and the message M.

Signature point
R = [r]B = Pt("JZ3EcatjuEMtUdu7apyj7qMyq4W6Cp8nkl+5zRlC2O8=")
Hash scalar
h = Sc(Hash(R ‖ A ‖ M)) = Sc("LaPzgJi44B8YFbZ/vcSeEPHG5NLyyad0qKSBPDrxqQs=")

Unlike vanilla Schnorr, we include the public key A to values being hashed.

Signature scalar
s = r + h*a = Sc("2d6FPkzBkI6/X28mCDQ/Crmsl055O6rj4mvq8rdOhQc=")

Verification

Verification uses the equation following from Schnorr and the modified signing procedure:

[s]B == R + [H(R ‖ A ‖ M)]A.
Hash scalar
h = Sc(Hash(R ‖ A ‖ M)) = Sc("LaPzgJi44B8YFbZ/vcSeEPHG5NLyyad0qKSBPDrxqQs=")

Hash scalar can be readily recreated from public information.

EC point
R′ = [s]B - [h]A = Pt("JZ3EcatjuEMtUdu7apyj7qMyq4W6Cp8nkl+5zRlC2O8=")

To verify whether signature is valid, it’s enough to compare R′ to first 32 bytes of the signature (i.e., R).