the following rfc describes the key-pair generation mechanism for Ed25519; the first two steps are as follows:

  1. Hash the 32-byte private key using SHA-512, storing the digest in a 64-octet large buffer, denoted h. Only the lower 32 bytes are used for generating the public key.
  1. Prune the buffer: The lowest three bits of the first octet are cleared, the highest bit of the last octet is cleared, and the second highest bit of the last octet is set.

I am not sure I understand what the seconde step accomplishes.. More concretely, if one were to replace SHA-512 by another hash function, let say blake2 for efficiency is the pruning(encoding) still necessary? and why? are there security relevant properties related to that?



1 Answer 1


The second step has nothing to do with the first step. It doesn't matter which hash is used in the first step. For X25519, which operates on an equivalent curve Curve25519, the private key is obtained by randomly generating 32 bytes and the first step of using that key is to apply the bit pruning step (clear bits 0, 1, 2 and 255 and set bit 254).

Clearing bit 255 ensures that the key is in the range $0..2^{255}-1$ where the operations are defined. Setting bit 254 improves performance when operations are implemented in a way that doesn't leak information about the key through timing. Clearing the low-order bits counters attacks that force the use of a weak key.

  • $\begingroup$ Setting bit 254 doesn't improve performance. The selected answer of the referenced question is just wrong, look at the most voted answer instead of the selected one $\endgroup$
    – Ruggero
    Nov 21, 2023 at 16:45
  • $\begingroup$ @Ruggero I don't see how DrLecter's answer is wrong, though it is uninformative because it basically just says “go read the paper”. Samuel Neves goes into more detail: if bit 254 was not forced, then the Montgomery ladder would need to start by finding the top bit, which takes extra time and leaks the position of the top bit through timing if implemented carelessly. $\endgroup$ Nov 21, 2023 at 17:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.