[saag] Using Ed25519 / Ed448 for encryption

[Phillip Hallam-Baker <[e-mail]>]

OK, so why would someone want to do this when we have the Montgomery
curves? There are two answers.

First, if there is going to be crypto accelerator hardware, VLSI fabs are
likely to want to have one coprocessor for one algorithm rather than two.

Second, the meta-cryptographic techniques I am using in the Mesh don't work
using the Montgomery ladder approach. I need to be able to add arbitrary
points. So to use the CurveX implementations, I would have to convert the
points to Edwards, add and convert back.

For the Mesh, I am just using Ed448 for both. But I am going to have to
start thinking about other applications soon.

Should I write a draft describing how to convert between the curves with
some test vectors or a draft on my approach to using Ed448 for key
agreement?