Given an Ed25519 key pair, can you think of any way to get to the same X25519 public key from the Ed25519 secret as from the non-clamped(!) Ed25519 public key?

Ed25519 secret
    \=> Ed25519 non-clamped public
            \=> X25519 public (transported)

                v^ should match 

            /=> X25519 public (generated)
    /=> X25519 secret (transported)
Ed25519 secret

My Stackoverflow question has some libsodium calls for further illustration.

What about the inverse:

X25519 secret
    \=> X25519 public (generated)
            \=> Ed25519 non-clamped public (transported)

                v^ should match 

            /=> Ed25519 non-clamped public (generated)
    /=> Ed25519 secret (transported)
X25519 secret
  • $\begingroup$ Using the same key for different purposes is not recommended!. Besides the there is no isomorphism between the twisted Edward curve and Curve25519, they are bi-rationally equivalent means that some finite points are not mapped in forward and backward mappings. $\endgroup$
    – kelalaka
    Commented Nov 2, 2023 at 10:03
  • $\begingroup$ Also, the Clamping removes the small orders and sets the higher bits to eliminate a possible side-channel attack. Now how can you map $n$ elements to $8n$ elements? The best is to keep it Clamped, and still not advised or you need to use exact rules crypto.stackexchange.com/a/42536/18298 $\endgroup$
    – kelalaka
    Commented Nov 2, 2023 at 10:07
  • $\begingroup$ @kelalaka If you handle $\infty$ in Curve25519, Ed25519 and Curve25519 are isomorphic, I thought. The birational equivalence works for all Curve25519 points except $\infty$, and to complete the isomorphism you can set $\infty_{\text{Curve25519}} = {(0,1)}_{\text{Ed25519}}$. $\endgroup$
    – Myria
    Commented Nov 2, 2023 at 21:56
  • $\begingroup$ @Myria if you are talking about the clamped yes, otherwise $(0,0)$ and $(0,1)$ $\endgroup$
    – kelalaka
    Commented Nov 3, 2023 at 6:18
  • 1
    $\begingroup$ Every public key of X25519 constitutes 2 public keys for Ed25519. How are you gonna solve this in your implementation? $\endgroup$
    – kelalaka
    Commented Nov 7, 2023 at 7:21


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.