Public Key generation for Ed25519 vs X25519

Question

It is my understanding that EdDSA uses a slight variant of Curve25519 (typically used for ECDH), called Ed25519.

Given the same private key, are the differences between the two algorithms enough to make the resulting public keys different between X25519 and Ed25519?

In other words, if I'm writing code to generate private/public key pairs, do I need separate implementations for EdDSA/Ed25519 and ECDH/X25519?

Clarification: I realize that EdDSA mandates a SHA-512 step which ECDH/X25519 does not specify. I'm curious if the public keys are the same for the given input to the scalar multiplication step.

Answer 1

The public key representations are related but not the same. They cannot be used interchangeably without additional processing.

The curves are birationally equivalent; a point on a curve has an equivalent on the other curve.

So, given an EdDSA public and/or private key, you can compute an X25519 equivalent. Libraries such as libsodium provide functions to perform these computations.

Of course, it also works the other way round, even though this is slightly more convoluted due to the fact that the sign is not present in encoded X25519 keys.

There are alternatives. One of them is to use the same curve for both operations. There is nothing wrong with using Ed25519 for DH.

If what you need is store a single secret, you can simply use it for both operations. You will get 2 public keys, but given how small they are, it is rarely an issue.

Speaking of which, is storing a combined 64 byte key instead of a 32 byte key really an issue? For most applications, it rarely is.