[curves] XEdDSA specification

[Trevor Perrin]

(Changing title)

On Thu, Oct 20, 2016 at 10:52 PM, Ron Garret <ron at flownet.com> wrote:
> You derive DSA keys from DH keys using the bilateral equivalence relation and setting the sign bit to zero.  Why not instead go the other way and derive DH keys from DSA keys?  That way you get to keep the sign bit.  One bit is not a big deal, but was there a reason for going DH->DSA instead of the other way?

Sure, it allows the Montgomery ladder for DH, see discussion at
beginning of 2.3.

Trevor