ed25519 is defined over curve edwards25519 which has a large prime order subgroup and a small subgroup of order 8.
During key generation, bit clamping is used to derive the private key scalar. In https://eprint.iacr.org/2020/823.pdf, Section 4.2.3, the authors describe the effect of clamping the lower order bits as follows:
Clearing the low bits ensures that the scalar is a multiple of the cofactor. This ensures that the result of applying the scalar to any group element results in an element in the prime order subgroup.
Question:
If I read the above correctly, the authors state that for any scalar r and curve point P, the result of P * clamp(r) is guaranteed to be in the prime order subgroup. Why is that?
clamp(r)is by construction a multiple of $8$. The full group has order $8\ell$ where $\ell$ is prime. – fgrieu Jan 22 '24 at 17:35