How do I convert an ed25519 scalar into x25519 for encryption?

In a system I'm working with, we're using Schnorr signatures with scalars generated with libsodium's crypto_core_ed25519_scalar_random.

My goal is to use the crypto_box_easy / crypto_box_open_easy routines where Alice and Bob each have their own Scalars / Points already previously generated with crypto_core_ed25519_scalar_random and crypto_scalarmult_ed25519_base_noclamp, respectively.

I did not want to use crypto_box_keypair because I want to re-use the existing keys which Alice and Bob already have.

I've tried to use the crypto_sign_ed25519_sk_to_curve25519 / crypto_sign_ed25519_pk_to_curve25519 routines to convert the Ed25519 scalar/points to x25519. However decryption fails, so this does not seem to be the correct approach.

This routine only seems to work when the keypairs were generated with crypto_sign_ed25519_keypair, and not crypto_core_ed25519_scalar_random and crypto_scalarmult_ed25519_base_noclamp.

So the question is, what is the right way to derive a key-pair for encryption if I only have a key-pair for signing which was generated with crypto_core_ed25519_scalar_random and crypto_scalarmult_ed25519_base_noclamp?

• Coding questions are off topic. If you are asking how to convert from ed25519 scalar into x25519 then that's on topic. All the other parts including the code are considered off topic here and should be removed from the question. They would be on topic on Stack Overflow, and you may of course advertise it below this stripped question using a comment or on the side channel chat. – Maarten Bodewes Jan 28 at 8:57
• Actually a deeper question for me is what is the difference between an ed25519 scalar and ed25519 secret key. If I could get from the scalar to the secret key, then all of my problems would be solved. – Andrej Mitrović Jan 28 at 9:53
• A scalar is more of a mathematical notion, it's largely synonymous with "vector" in this case. The private key is therefore a scalar when it is used for point multiplication, but a scalar is not necessarily a private key. But yeah, maybe somebody with more of a math background would be able to explain this all in detail. – Maarten Bodewes Jan 28 at 10:22
• You might get a lot of insight from this Q/A (I'd start with the answers before you get wrongfooted by the question first...) – Maarten Bodewes Jan 28 at 10:27
• Thanks for the pointers. I think it's probably best if I ask my question in the libsodium repo. Apologies if my original question is off-topic. Please feel free to close. – Andrej Mitrović Jan 28 at 13:55