[curves] Ed25519 "clamping" and its effect on hierarchical key derivation

[Oleg Andreev]

> On 7 Apr 2017, at 16:57, Ron Garret <ron at flownet.com> wrote:
> 
> 
> On Apr 7, 2017, at 2:17 PM, Oleg Andreev <oleganza at gmail.com> wrote:
> 
>> For instance, NaCl API accepts 64-byte secret
> 
> Not really.  What appears to be a 64 byte secret key is actually a 32-byte secret key concatenated with the corresponding 32-byte public key.

I noticed that for the Go ed25519 library, but in my copy of NaCl from 2011, 64-byte string is the scalar concatenated with "prefix" (term from EdDSA). See: https://gist.github.com/oleganza/78c9e30f8e292aa8b3aff849a1c28f2c#file-sign-c-L30-L70

PS. I was initially confused to learn that Go library uses 64-byte string to attach pubkey to a 32-byte scalar preimage. That's unfortunate, but I expect everyone else to be confused about this too for a long time to come.