# Encoding scalar values to points on Ed25519

I'm interested exploring key derivation and threshold signature protocol that require point arithmetic (addition) on the private scalar values and $S$ values of the signatures in .

Specifically what I would like to be able to do

1. Generate two eddsa private keys: (pub_1,key_1), (pub_2,key_2)
2. Compute the private scalar for each. key_1 -> exp_key_1 , key2 -> exp_key_2
3. Convert the keys to ed25519 points. exp_key_1 -> pt_1, exp_key_2 ->pt_2
4. Add the points to each other to get a third point. pt_1 + pt_2 -> pt_3
5. The sum of the points multiplied by the base point is expected to equal sum of the original public keys. Knowing how to convert the sum of the points to the base point would also be nice pt_3 * G == pub_1 + pub_2

The part of the this process that is least clear to me is step 3.

The ref10 code makes it easy to do point arithmetic on public key. Just decode and do the add point addition as per question Point addition and doubling in Ed25519 (ref10)?

Using the raw bytes to Point decoder on the scalar fails about half the time and when it succeeds the expected homomorphisms don't hold; i.e.: $(a+b)\times G == A+B$

I'm aware the libsecp256k1 makes these sorts of manipulations very easy. I think it would be useful to be that on curve25519.

• The scalar multiplication routines in Ref10 set the most significant bit of the scalar to 1, which interacts badly with computed scalars. You need to remove those masking code lines. Oct 11, 2015 at 18:35
• I believe the masking code you refering to is "expandedSecretKey[0] &= 248 expandedSecretKey[31] &= 63 expandedSecretKey[31] |= 64". Removing that doesn't seem to improve to situation situation with secretKey to Point conversion. Oct 11, 2015 at 19:07
• Then please clarify your question and include what you're doing and what the expected result is. Oct 11, 2015 at 19:14
• I'll give it a try. Oct 11, 2015 at 19:16