warner/pycryptopp — comment on commit 0c79f21f3157aabfa8a3f376181441e24a34114f
File: README.ed25519 line 34
By zooko:

But the target security level of Ed25519 is 128 bits, so why is the private key 256 bits?

Put it another way: suppose we always left the top 128 bits of the private key fixed to 0 bits, and populated the other 128 bits with os.urandom(16). (Then we could omit those from serialized forms of the private key.) Would that enable some attack at a cost of less than 2¹²⁸?

Hypothesis: Ed25519 private keys are 32 bytes long because the designer doesn't imagine sticking keys into such tight spots as user-manipulable caps, and he likes using twice as many bits as necessary to meet the security level target, when those bits hardly cost anything. For some purposes that we might someday put Ed25519 to, those bits are costly! (Adding an additional 26 ASCII characters into the ASCII representation of a cap, for example.)

Note that the only thing Ed25519 does with the private key is use SHA-512 to expand it into the 64-byte internal private key, so it rather sounds like any weakness induced by my proposed optimization would imply a very surprising weakness in SHA-512.