evaluate this lib

[ebuchman]

• it's a fork of agl/ed25519, which was later merged into golangs x/crypto https://godoc.org/golang.org/x/crypto/ed25519
• the repos have diverged somewhat
• do we even need the fork ?

[liamsi]

Development happens here: https://github.com/golang/crypto/tree/master/ed25519

do we even need the fork ?

As long as we don't use any functionality from the internal package (if, I don't see where we do), we should rather use the maintained golang/crypto version instead. There were some changes recently that adapt to a published RFC to prevent signature malleability.

(Also this might be related dedis/kyber#117)

[liamsi]

I had a slightly closer look at go-crypto this weekend. There, we do in fact use two methods (extra25519.PublicKeyToCurve25519 and PrivateKeyToCurve25519) which are not part of x/crypto:

https://github.com/tendermint/go-crypto/blob/915416979bf70efa4bcbf1c6cd5d64c5fff9fc19/pub_key.go#L69-L76

and

https://github.com/tendermint/go-crypto/blob/7fb3f704b38492fb24cc6f807baee524ef7f4f8d/priv_key.go#L63-L68

@ebuchman noticed this here already.