EdDSA for more curves describes two options of signature verification
- Verification, which checks $2^c\,S\,B\,=\,2^c\,R+2^c\,H(\underline R,\underline A,M)\,A$
- Cofactorless verification, which checks $S\,B\,=\,R+H(\underline R,\underline A,M)\,A$
Cofactorless verification is more stringent: "any alleged signature that passes cofactorless verification will also pass verification", but "a signer using a secret key outside the normal signing procedure can create strings that pass verification without passing cofactorless verification".
So, what's the rationale for the first kind of verification, with cofactor $2^c$? Why would it be faster / simpler, if it is that at all?
Update: after looking at this answer and it's references, I wonder if the only reason Verification¹ is defined is so that it holds the following
Proposition: If a set of signatures passed batch verification, then each signature passes Verification¹ with cryptographic certainty (including if signers are intentionally messing up or if adversaries modify signatures).
Is this proposition true? What's a proof? Why would not it hold if Verification was defined as Cofactorless verification?
Is there any other reason for Verification with cofactor? Like, a Fast Single-Signature Verification as in section 5 of Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, and Bo-Yin Yang, High-Speed High-Security Signatures, in proceedings of CHES 2011)?
¹ Verification as defined above, that is with cofactor $2^c$.