[Cfrg] Should Ed25519 use a pseudo-random generator point?

[Bill Cox <[e-mail]>]

Sorry again for my arm-chair level of crypto knowledge.  I think the answer
is "no", especially given how far Ed25519 is along the standardization
path, but here's my arm-chair concern anyway.  Does using 4/5 as the X
coordinate of the generator have speed benefits or any other benefit?

I am concerned that using 4/5 as the X-coordinate might lead to an attack
someday.  I think this is _very_ unlikely, but is it worth worrying about?
Instead of using 4/5 for g's X coordinate, we could use SHA256(n), where n
is the smallest non-negative integer that puts g in the right group.

When we know the rational X coordinate of the generator point g, then we
can easily map any point m*g to m*h, where h is very to the origin.  On the
actual curve, not mod p, the point m*h would wrap around the curve
typically at most once, given any m < p.  While this seems to mean nothing
mod p, given floating-point representations of m*g on the curve, it is
easier to compute m without wrapping around the curve many times.  I am not
saying this implies anything about ECC security in any way, but it makes me
go "hmm..."

Given this lame geometric insight, and also how the NIST curves did not
offer any justification for how their generator points were derived, I am
concerned that there might be some weakness in ECC that can only be
exploited when we know the rational X-coordinate of the generator.  Is
there any harm in using a generator with a pseudo-random X coordinate?

Bill