Ed25519

Ed25519 signatures (RFC 8032), pure Kotlin. Used by libtorrent for BEP-44 mutable DHT items; the C++ lives under src/ed25519/ (ref10: ge.cpp, fe.cpp, sc.cpp, sign.cpp, keypair.cpp, verify.cpp).

Rather than transcribing ref10's hand-rolled radix-2^25.5 field arithmetic and its giant precomputed base-point table (extremely error-prone), this is a compact textbook implementation:

• field arithmetic mod p = 2^255 - 19 via BigInt;

• the twisted Edwards curve -x^2 + y^2 = 1 + dx^2y^2 in extended coordinates (X,Y,Z,T) with the standard add/double formulas;

• scalar multiplication by constant-position double-and-add;

• SHA-512 from Sha512 for the key/nonce/challenge hashes;

• scalars reduced mod the group order L = 2^252 + 27742317777372353535851937790883648493.

Slower than ref10 but correct and small. Validated against the RFC 8032 / libgcrypt vectors that libtorrent itself uses (see test/test_ed25519.cpp).

Key layout matches libtorrent exactly:

• createKeypair(seed32) -> (publicKey 32, privateKey 64) where privateKey = SHA-512(seed); privateKey[0..32) is the clamped scalar a, privateKey[32..64) is the nonce prefix.

• sign / verify operate on those 32/64-byte blobs.