the following rfc describes the key-pair generation mechanism for Ed25519; the first two steps are as follows:

  1. Hash the 32-byte private key using SHA-512, storing the digest in a 64-octet large buffer, denoted h. Only the lower 32 bytes are used for generating the public key.

  2. Prune the buffer: The lowest three bits of the first octet are cleared, the highest bit of the last octet is cleared, and the second highest bit of the last octet is set.

I am not sure I understand what the seconde step accomplishes.. More concretely, if one were to replace SHA-512 by another hash function, let say blake2 for efficiency is the pruning(encoding) still necessary? and why? are there security relevant properties related to that?



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.