# Ed25519 with R replaced by H(RAM)?

Ed25519 signatures consist of $(R, s)$, where $s = r + H(RAM)a$ $mod$ $l$, and $R = rB$. This differs from the Schnorr signature where instead of $R$, the signature contains the hash $h=H(RAM)$. According to the Elligator paper (page 5) "one can reconstruct $(h, s)$ from $(R, s)$ and vice versa".

I see that $(R, s) => (h, s)$ is trivial, but how would one derive $(R, s)$ from $(h, s)$?

Or more generally, how would the verification equation look like with $(h, s)$ as the signature?

(Motivation: I'd like to use $(h, s)$ as the signature to get indistinguishability from random numbers without needing the Elligator 2 map. Probably means no bulk verification, but that's not needed for what I'm thinking about.)

Unless I am missing something, I believe that you can simply compute $R = s*B - h*A$ using point subtraction.
• I guess you then just compare $h$ to $H((sB-hA)AM)$ for verification? – otus May 20 '14 at 5:34
• I had to do $R = -(h*A-s*B)$ instead. Seems weird, but I think has to do with the modulus $l$. I'll have to figure it out. Pointers would be appreciated. – otus May 20 '14 at 7:02