I'm interested exploring key derivation and threshold signature protocol that require point arithmetic (addition) on the private scalar values and $S$ values of the signatures in ed25519.
Specifically what I would like to be able to do
- Generate two eddsa private keys: (pub_1,key_1), (pub_2,key_2)
- Compute the private scalar for each. key_1 -> exp_key_1 , key2 -> exp_key_2
- Convert the keys to ed25519 points. exp_key_1 -> pt_1, exp_key_2 ->pt_2
- Add the points to each other to get a third point. pt_1 + pt_2 -> pt_3
- The sum of the points multiplied by the base point is expected to equal sum of the original public keys. Knowing how to convert the sum of the points to the base point would also be nice pt_3 * G == pub_1 + pub_2
The part of the this process that is least clear to me is step 3.
The ref10 code makes it easy to do point arithmetic on public key. Just decode and do the add point addition as per question “Point addition and doubling in Ed25519 (ref10)?”
Using the raw bytes to Point decoder on the scalar fails about half the time and when it succeeds the expected homomorphisms don't hold; i.e.: $(a+b)\times G == A+B$
I'm aware the libsecp256k1 makes these sorts of manipulations very easy. I think it would be useful to be that on curve25519.