ed25519 problem with libsodium implementation S_a + S_b = (s_a+s_b)*G

Question

I'm trying to make my own implementation of atomic swaps by following this article. I use a low level node.js bindings for libsodium for this.

If I understand the protocol correctly, then Alice and Bob have private keys (s_a, s_b) and public keys: S_a = s_aG, S_b = s_bG. Where G=5866666666666666666666666666666666666666666666666666666666666666 (base point of the ed25519 elliptic curve)

Thus, the relation should be fulfilled: S_a + S_b = (s_a+s_b)*G. But I can't achieve this equality. This is my simple JavaScript code:

    const sodium = require('sodium-native')

    let s_a = Buffer.from("0400000000000000000000000000000000000000000000000000000000000000", 'hex');
    let s_b = Buffer.from("0600000000000000000000000000000000000000000000000000000000000000", 'hex');
    let S_a = Buffer.alloc(sodium.crypto_core_ed25519_BYTES);
    let S_b = Buffer.alloc(sodium.crypto_core_ed25519_BYTES);
    
    sodium.crypto_scalarmult_ed25519_base_noclamp(S_a, s_a); //S_a = s_a*G
    sodium.crypto_scalarmult_ed25519_base_noclamp(S_b, s_b); //S_b = s_b*G
    
    let sumPublic = Buffer.alloc(sodium.crypto_core_ed25519_BYTES);
    let sumPrivate = Buffer.alloc(sodium.crypto_core_ed25519_BYTES);
    let test = Buffer.alloc(sodium.crypto_core_ed25519_BYTES);

    sodium.crypto_core_ed25519_add(sumPublic, S_a, S_b); //sumPublic = S_a + S_b
    sodium.crypto_core_ed25519_add(sumPrivate, s_a, s_b); //sumPrivate = s_a + s_b

    sodium.crypto_scalarmult_ed25519_base_noclamp(test, sumPrivate); //test = sumPrivate*G = (s_a + s_b)*G

    console.log("sumPublic = " + sumPublic.toString('hex'))
    console.log("test = " + test.toString('hex'))

Console output:

sumPublic = 2c7be86ab07488ba43e8e03d85a67625cfbf98c8544de4c877241b7aaafc7fe3
test = dbd33860dbf1de64256a42dad3069befdc07094809a620130a41a85740863432

But "sumPublic" must be same as "test" !? Because test = (s_a + s_b)G = s_aG + s_bG = S_a + S_b = sumPublic

Where is my error?

Answer 1

This:

sodium.crypto_core_ed25519_add(sumPrivate, s_a, s_b); //sumPrivate = s_a + s_b

is wrong. crypto_core_ed25519_add adds points, not scalars. For adding scalars you should use crypto_core_ed25519_scalar_add.