How to convert X25519 to Ed25519 key properly so it's combatible with curve-js js lib?

[devlikepro]

Hi!
We're trying to migrate from one 26 stars curve-js library (https://github.com/harveyconnor/curve25519-js) to libsodium in JS (Node) using libsodium-wrappers package.
The main purpose - libsodium is sooo fast if we compare it with pure-js implementaiton and other libraries, thank you for that! 🫶

The library seems to implement the standard X25519 and Ed25519 algorithm, just as libsodium

But the curve-js main focus on x25519 keys and from it the lib converts Curve25519 secret key into Ed25519 secret key and converts Curve25519 public key back to Ed25519 public key in an interesting way (not sure if it's standard of doing that)

So there's 4 operations we need, basically:

1. ✅ Generate x25519 pair keys from seed (done via sodium.crypto_box_seed_keypair)
2. ✅ Calculate shared secret from x25519 keys (alice public + bob private) (done via sodium.crypto_scalarmult)
3. ✅ Verify Ed25519 signature from x25519 private key - done using curvejs.convertPublicKey AND two bit tricks before passing the result to sodium.crypto_sign_verify_detached.
4. 🚫 Calculate Ed25519 signature using x25519* private key - that one I didn't manage to reproduce with THE SAME signature result as curve-js returns 😞 I tried using sodium.crypto_sign_detached and tried to covert x25519 to Ed25519 just as curvejs do during signature process, but no luck so far :(

---

So my questions about those:

3. ✅ Verify Ed255 signature from x25519 private key

1. Is there a way to do the same as curvejs.convertPublicKey does using libsodium? The last two bits operations we can do in js, if it's too specific to this implementation, not a problem.

4. 🚫 Calculate Ed25519 signature using x25519* private key

2. How can we make it work so both old lib and libsodium validates the resulting signature 😢

I'm not super familiar with the details of curve25519 and Ed25519, but may be someone who is familiar could check that and give me the right direction where tooo look?

I can provide the minimum reproducible tests and code, if anyone need.

[devlikepro]

@jedisct1 sorry for mentioning you directly, but maybe you could help with creating the caption 🙏

[purpshell]

i will look into this

[jedisct1]

Ed25519 secret keys are made of the seed, and the public key.

The seed is hashed in order to compute the secret scalar. libsodium doesn't let you directly set the scalar.

So, the only option is to reimplement Ed25519, with the low-level crypto_core_* APIs, which is not available in the JavaScript wrappers yet.

That requires a bit of work.

Things would be way easier, without non-standard hacks if done the other way round (Ed25519 keys used both for signatures and key exchange). Also see How can I sign and encrypt using the same key pair? in the FAQ.