Ed25519 key generation

Question

the following rfc describes the key-pair generation mechanism for Ed25519; the first two steps are as follows:

1. Hash the 32-byte private key using SHA-512, storing the digest in a 64-octet large buffer, denoted h. Only the lower 32 bytes are used for generating the public key.

2. Prune the buffer: The lowest three bits of the first octet are cleared, the highest bit of the last octet is cleared, and the second highest bit of the last octet is set.

I am not sure I understand what the seconde step accomplishes.. More concretely, if one were to replace SHA-512 by another hash function, let say blake2 for efficiency is the pruning(encoding) still necessary? and why? are there security relevant properties related to that?

Thanks!

Answer 1

The second step has nothing to do with the first step. It doesn't matter which hash is used in the first step. For X25519, which operates on an equivalent curve Curve25519, the private key is obtained by randomly generating 32 bytes and the first step of using that key is to apply the bit pruning step (clear bits 0, 1, 2 and 255 and set bit 254).

Clearing bit 255 ensures that the key is in the range $0..2^{255}-1$ where the operations are defined. Setting bit 254 improves performance when operations are implemented in a way that doesn't leak information about the key through timing. Clearing the low-order bits counters attacks that force the use of a weak key.