I'm trying to make my own implementation of atomic swaps by following this article. I use a low level node.js bindings for libsodium for this.

If I understand the protocol correctly, then Alice and Bob have private keys (s_a, s_b) and public keys: S_a = s_aG, S_b = s_bG. Where G=5866666666666666666666666666666666666666666666666666666666666666 (base point of the ed25519 elliptic curve)

Thus, the relation should be fulfilled: S_a + S_b = (s_a+s_b)*G. But I can't achieve this equality. This is my simple JavaScript code:

    const sodium = require('sodium-native')

    let s_a = Buffer.from("0400000000000000000000000000000000000000000000000000000000000000", 'hex');
    let s_b = Buffer.from("0600000000000000000000000000000000000000000000000000000000000000", 'hex');
    let S_a = Buffer.alloc(sodium.crypto_core_ed25519_BYTES);
    let S_b = Buffer.alloc(sodium.crypto_core_ed25519_BYTES);
    sodium.crypto_scalarmult_ed25519_base_noclamp(S_a, s_a); //S_a = s_a*G
    sodium.crypto_scalarmult_ed25519_base_noclamp(S_b, s_b); //S_b = s_b*G
    let sumPublic = Buffer.alloc(sodium.crypto_core_ed25519_BYTES);
    let sumPrivate = Buffer.alloc(sodium.crypto_core_ed25519_BYTES);
    let test = Buffer.alloc(sodium.crypto_core_ed25519_BYTES);

    sodium.crypto_core_ed25519_add(sumPublic, S_a, S_b); //sumPublic = S_a + S_b
    sodium.crypto_core_ed25519_add(sumPrivate, s_a, s_b); //sumPrivate = s_a + s_b

    sodium.crypto_scalarmult_ed25519_base_noclamp(test, sumPrivate); //test = sumPrivate*G = (s_a + s_b)*G

    console.log("sumPublic = " + sumPublic.toString('hex'))
    console.log("test = " + test.toString('hex'))

Console output:

sumPublic = 2c7be86ab07488ba43e8e03d85a67625cfbf98c8544de4c877241b7aaafc7fe3
test = dbd33860dbf1de64256a42dad3069befdc07094809a620130a41a85740863432

But "sumPublic" must be same as "test" !? Because test = (s_a + s_b)G = s_aG + s_bG = S_a + S_b = sumPublic

Where is my error?

1 Answer 1



sodium.crypto_core_ed25519_add(sumPrivate, s_a, s_b); //sumPrivate = s_a + s_b

is wrong. crypto_core_ed25519_add adds points, not scalars. For adding scalars you should use crypto_core_ed25519_scalar_add.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.