# A matching X25519 public from non-clamped Ed25519-public and Ed25519-secret

Given an Ed25519 key pair, can you think of any way to get to the same X25519 public key from the Ed25519 secret as from the non-clamped(!) Ed25519 public key?

Ed25519 secret
\=> Ed25519 non-clamped public
\=> X25519 public (transported)

v^ should match

/=> X25519 public (generated)
/=> X25519 secret (transported)
Ed25519 secret


My Stackoverflow question has some libsodium calls for further illustration.

X25519 secret
\=> X25519 public (generated)
\=> Ed25519 non-clamped public (transported)

v^ should match

/=> Ed25519 non-clamped public (generated)
/=> Ed25519 secret (transported)
X25519 secret

• Using the same key for different purposes is not recommended!. Besides the there is no isomorphism between the twisted Edward curve and Curve25519, they are bi-rationally equivalent means that some finite points are not mapped in forward and backward mappings. Commented Nov 2, 2023 at 10:03
• Also, the Clamping removes the small orders and sets the higher bits to eliminate a possible side-channel attack. Now how can you map $n$ elements to $8n$ elements? The best is to keep it Clamped, and still not advised or you need to use exact rules crypto.stackexchange.com/a/42536/18298 Commented Nov 2, 2023 at 10:07
• @kelalaka If you handle $\infty$ in Curve25519, Ed25519 and Curve25519 are isomorphic, I thought. The birational equivalence works for all Curve25519 points except $\infty$, and to complete the isomorphism you can set $\infty_{\text{Curve25519}} = {(0,1)}_{\text{Ed25519}}$. Commented Nov 2, 2023 at 21:56
• @Myria if you are talking about the clamped yes, otherwise $(0,0)$ and $(0,1)$ Commented Nov 3, 2023 at 6:18
• Every public key of X25519 constitutes 2 public keys for Ed25519. How are you gonna solve this in your implementation? Commented Nov 7, 2023 at 7:21