The standardization document for Ed25519, RFC 8032, says the following method should be used for verifying Ed25519 signatures:
- Check the group equation $[S]B = R + [k]A'$. It's sufficient, but not required, to instead check $[S]B = R + [k]A'$.
Does that mean that code doing verification should point-multiply both sides by $8 = 2^c$ for cofactor $c$ or should they not? The document and various questions here on CryptoExchange don't really answer whether I as implementer should multiply both sides by $8$ when implementing the standard.
I understand what the number $8$ is; the order of the Ed25519 cyclic group is $8\ell$ for a 253-bit prime $\ell$, and $|B| = \ell$. So $B$ is pre-multiplied by $8$ to make it part of the $\ell$-order subgroup.