# Compact ROM with space only for EdDSA. How to fit a key exchange algorithm inside?

I have implemented Ed25519 for a constrained-memory system, and I want to provide a Shared Secret functionality. The recommended method is to use X25519 for this; but then I would have to implement point multiplication over the Montgomery curve Curve25519, which I don't really have room for.

Would there be any downside to using Ed25519 directly for this? In other words, if PrK is my private key and PuK is your public key, our shared secret is [PrK]PuK computed over the curve Ed25519, and not the curve Curve25519. Perhaps then I could hash the result, as Bernstein recommends for X25519.

I am aware of two possible issues: firstly, Curve25519 is slightly faster here; but this is not a serious problem in my application. Secondly, such a custom algorithm is not recommended by any standard; this is a more serious problem, but I can live with it. Does anybody know of any more potential problems with this approach?

• – kelalaka Oct 9 '20 at 22:47
• @kelalaka: Yes, thanks. I saw this. But it doesn't say anything about whether using Ed25519 directly for Shared Secret generation might be a bad idea. – TonyK Oct 9 '20 at 22:51
• The constant time due to the Montgomery ladder? Also, did you see the Squamish comment there? – kelalaka Oct 9 '20 at 22:52
• @kelalaka: My Ed25519 implementation is also constant-time. And Squeamish Ossifrage made three comments on that page, so I'm not sure which one you mean. In any case, nobody seems to have any theoretical reasons not to use Ed25519, so I think I'll go with that. But should I hash the result? – TonyK Oct 9 '20 at 23:00
• You need to KDF the result, not just hash it. – SAI Peregrinus Oct 10 '20 at 2:26

There is no inherent reason that you can't use edwards25519 for ECDH. We've been doing ECDH with all kinds of curves for ages already, and edwards25519 works just fine as any other. You need to take the same precautions as for X25519, too: multiply by the cofactor $$h=8$$ or check against a blacklist of bad points (but the encoding of those points will differ between compressed edwards25519 points as for Ed25519 and X25519).