The Confusing Thing About X25519 and Ed25519

Head spinning time. With Curve 25519, we can have Ed25519 and X25519, and whereEd25519 is used for digital signatures (and a replacement for RSA and ECDSA), and X25519 is used for key exchange (and a replacement for ECDH). Both use Curve 25519 as their base. But, one uses Curve 25519 and which is a Montgomery Curve (X25519), and the other uses a twisted Edwards Curve (Ed25519).

And so, Ed25519 uses the twisted Edwards curve used by Ed25519 and the Montgomery curve is used by X25519, but where you can convert between the two. We normally defines points on an Edwards curve as (x, y), and (u, v)for a Montgomery curve. The specification of the conversion from Edwareds to Mongomery (and vice-versa) is defined in RFC 7748 as:

(u, v) = ((1+y)/(1-y), sqrt(-486664)*u/x)
(x, y) = (sqrt(-486664)*u/v, (u-1)/(u+1))

An X25519 public is actually u co-ordinate on Curve 25519 (Montgomery curve), and where we multiply a base point by our private key (and which is a random scalar value): Pub=priv.G. With an Ed25519 public key we have a compressed version of an (x,y) point on the Edwards curve, and where we hash a secret value to create the private key.

When the same secret scalar value is used, we can easily convert between Ed25519 and X25519, but where we have two values for Ed25519 (x,y), and only one value…