In the X3DH specification of the Signal Protocol it mentions having a signed pre-key in the key bundle. This pre-key is signed using the identity private-key.
Because the identity private-key is in the X25519 Montgomery form, it cannot be used as a signing key. Therefore signal implements XEdDSA to overcome this and converts the Montgomery form key into it's bi-rationally equivalent Edwards curve form, effectively allowing the same key to be used for key exchange and signing.
This is my limited understanding of what's taking place.
However, I'm wondering, is it possible to skip XEdDSA and still securely implement the Signal protocol (albeit modified) by having separate ed25519 keys (Edwards form) only for signing (using EdDSA).
In this situation:
- Would the separate (ed25519) public key be sent as an additional (long term) key in the bundle (same as the identitykey).
- Would we only need to continue signing the signed-pre key (using this ed25519 key), or will this introduce the need to also sign additional keys (since our additional signing key no longer matches with the original identitykey, possibly presenting a verification problem).