The Curve448 elliptic curve specified in [4] can be used with XEdDSA and VXEdDSA, giving XEd448 and VXEd448. This curve defines the following parameters.
| Name | Definition |
|---|---|
| B | convert_mont(5) |
| I | (x=0, y=1) |
| p | 2^448 - 2^224 - 1 |
| q | 2^446 - 13818066809895115352007386748515426880336692474882178609894547503885 |
| c | 4 |
| d | 39082 / 39081 (mod p) |
| A | 156326 |
| n | -1 |
| |p| | 448 |
| |q| | 446 |
| b | 456 |
The twisted Edwards curve equation is x^2 + y^2 = 1 + dx^2y^2. The u_to_y function implements the birational map from [4] by calculating y = (1 + u) * inv(1 - u) (mod p).
XEd448 differs from EdDSA [2] in choice of hash function. XEd448 uses SHA-512, whereas [2] recommends a 912-bit hash (912 = 2*b). If the hash function is secure, outputs larger than 512 bits don't add security with Curve448, so XEd448 makes a simpler choice.
XEd448 may differ from other proposed instantiations of EdDSA [13] which use the "4-isogenous" curve from [4] rather than the "birationally equivalent" curve. Mapping from the Montgomery form Curve448 to the isogenous curve is more complicated.