the following rfc describes the key-pair generation mechanism for Ed25519; the first two steps are as follows:
Hash the 32-byte private key using SHA-512, storing the digest in a 64-octet large buffer, denoted h. Only the lower 32 bytes are used for generating the public key.
Prune the buffer: The lowest three bits of the first octet are cleared, the highest bit of the last octet is cleared, and the second highest bit of the last octet is set.
I am not sure I understand what the seconde step accomplishes.. More concretely, if one were to replace SHA-512 by another hash function, let say blake2 for efficiency is the pruning(encoding) still necessary? and why? are there security relevant properties related to that?
Thanks!
