On Wed, Nov 2, 2016 at 4:53 PM, Brian Smith <br...@briansmith.org> wrote: > > Yes, I found (and find) it confusing that XEd448 is different than Ed448 in > obvious ways, but yet a of XEdDSA is to be co,[compatible with EdDSA in some > way. More on the equivalence of Ed25519 and XEd25119 below.
Yeah, I'd prefer Ed448 to be the equivalent of Ed25519 for the X448 curve (equivalent curve; same input encoding; same hash). But that's up to the IETF. > Assuming I didn't make a huge mistake, here's another factoring of the logic > that shows that XEd22519 signing can be used with either XEd25519 keys or > Ed25519 keys. In particular, the randomization of the nonce and the > derivation of an Ed25519 key from an X25519 key are orthogonal Sure, agreed that handling of nonce, and public key, are orthogonal. Trevor _______________________________________________ Curves mailing list Curves@moderncrypto.org https://moderncrypto.org/mailman/listinfo/curves