I recently read a question about sc_reduce32 I stumbled on while investigating on Monero's Mnemonic Seed working. A great tool has been llcoins which states the following when talking about conversions between the Hexadecimal and Mnemonic seed:
The "seeds" created by this method will always be valid scalars as they are sent to sc_reduce32 first.
Takes a 64-byte integer and outputs the lowest 32 bytes modulo the prime q. This is not a CryptoNote-specific function, but comes from the standard ed25519 library.
Takes a 32-byte integer and outputs the integer modulo q. Same code as above, except skipping the 64→32 byte step.
My question can be split in two:
- Why does the first statement imply that without
sc_reduce32, the hexadecimal seed would potentially be an invalid scalar?
- How is
qchosen? When looking at
crypto_ops::generate_keysI have the feeling that it can be a random scalar, not even prime.