# Encoding scalar values to points on Ed25519

I'm interested exploring key derivation and threshold signature protocol that require point arithmetic (addition) on the private scalar values and $S$ values of the signatures in .

Specifically what I would like to be able to do

1. Generate two eddsa private keys: (pub_1,key_1), (pub_2,key_2)
2. Compute the private scalar for each. key_1 -> exp_key_1 , key2 -> exp_key_2
3. Convert the keys to ed25519 points. exp_key_1 -> pt_1, exp_key_2 ->pt_2
4. Add the points to each other to get a third point. pt_1 + pt_2 -> pt_3
5. The sum of the points multiplied by the base point is expected to equal sum of the original public keys. Knowing how to convert the sum of the points to the base point would also be nice pt_3 * G == pub_1 + pub_2

The part of the this process that is least clear to me is step 3.

The ref10 code makes it easy to do point arithmetic on public key. Just decode and do the add point addition as per question Point addition and doubling in Ed25519 (ref10)?

Using the raw bytes to Point decoder on the scalar fails about half the time and when it succeeds the expected homomorphisms don't hold; i.e.: $(a+b)\times G == A+B$

I'm aware the libsecp256k1 makes these sorts of manipulations very easy. I think it would be useful to be that on curve25519.

• The scalar multiplication routines in Ref10 set the most significant bit of the scalar to 1, which interacts badly with computed scalars. You need to remove those masking code lines. – CodesInChaos Oct 11 '15 at 18:35
• I believe the masking code you refering to is "expandedSecretKey[0] &= 248 expandedSecretKey[31] &= 63 expandedSecretKey[31] |= 64". Removing that doesn't seem to improve to situation situation with secretKey to Point conversion. – zmanian Oct 11 '15 at 19:07
• Then please clarify your question and include what you're doing and what the expected result is. – CodesInChaos Oct 11 '15 at 19:14
• I'll give it a try. – zmanian Oct 11 '15 at 19:16

## 1 Answer

The problem may that ed25519-donna uses a decompression that inverts points. That's fixable, but from the description of the problem I think you might be mangling the point encoding somehow, and it isn't quite clear how.

• Is there in function in floodberry's ed25519-donna implementation that converts a scalar to a group element? I didn't see one. Thanks! – zmanian Oct 12 '15 at 0:46
• @zmanian Not sure what you mean by converting, but the closest analogy to such a conversion is scalar multiplication with the base point. – CodesInChaos Oct 12 '15 at 7:15