Why do Ed25519 use Twisted Edwards curve but not regular Edwards curve

I'm trying to understand benefits of using Twisted Edwards curve over regular Edwards curve. I'm aware of some properties of Twisted Edwards curve that regular Edwards curve missing like isomorphism and fact that every twisted Edwards curve is birationally equivalent to an elliptic curve in Montgomery form. But I can't get idea why it is beneficial for digital signature.

Little history;

As a conclusion, if we combine these works, we can see the reason as easy side-channel free implementations due to Montgomery Ladder on the Twisted Edwards and fast addition formulas.

Performance notes;

• Some details from the 2008 paper for explanation for performance of Twisted Edward curve;

This phenomenon is not an accident. Montgomery curves EM,A,B are normally chosen so that $$(A + 2)/4$$ is a small integer: this speeds up $$u$$-coordinate arithmetic, as Montgomery pointed out in 1997. The corresponding twisted Edwards curves have $$d/a$$ equal to $$(A − 2)/(A + 2)$$, a ratio of small integers, allowing fast arithmetic in twisted Edwards form.

• Ed25519 has batch verification of 64 sigantures enables greater speed advantage.

• More benefits of Ed25519 can be found at Bernstin's pages https://ed25519.cr.yp.to/

Note: While talking about fast formulas we should be careful since everything can change in the target platforms. As Squeamish Ossifrage pointed in the comment of the answer of Why Curve25519 for encryption but Ed25519 for signatures?

In certain circumstances it may be worthwhile to use X25519 with a Montgomery ladder even for signatures: qDSA seems to outperform EdDSA on microcontrollers, at substantially less memory and code size than other Edwards alternatives like FourQ

• seems like regular untwisted elliptic curves are also side-channel free and have fast formulas. Please, correct me, if I'm mistaken. Sep 12, 2023 at 12:31
• Mongomery Ladder provides the side-channel resistance by design. One should to bad implementation to not achieve that. I've added a referent to see that. Sep 12, 2023 at 12:46
• It may depend on the need, however, safey curce points no failures see E as Edwards safecurves.cr.yp.to/index.html Sep 12, 2023 at 13:19
• @pacman One reason is that Curve25519 is faster for ECDH (faster variable-base scalar mults), and Ed25519 is faster for signatures (faster variable-base scalar mult added to a fixed-base scalar mult). The speed difference is something like 15-20% Sep 12, 2023 at 14:30
• @pacman see page 14 of eprint.iacr.org/2008/013.pdf - there is a performance benefit of using Twisted Edwards over Edwards Sep 13, 2023 at 10:15