edの

// https://blog.filippo.io/using-ed25519-keys-for-encryption/

func ed25519PrivateKeyToCurve25519(pk ed25519.PrivateKey) []byte {
    h := sha512.New()
    _, _ = h.Write(pk.Seed())
    out := h.Sum(nil)
    return out[:curve25519.ScalarSize]
}

var curve25519P, _ = new(big.Int).SetString("57896044618658097711785492504343953926634992332820282019728792003956564819949", 10)

func ed25519PublicKeyToCurve25519(pk ed25519.PublicKey) []byte {
    // ed25519.PublicKey is a little endian representation of the y-coordinate,
    // with the most significant bit set based on the sign of the x-coordinate.
    bigEndianY := make([]byte, ed25519.PublicKeySize)
    for i, b := range pk {
       bigEndianY[ed25519.PublicKeySize-i-1] = b
    }
    bigEndianY[0] &= 0b0111_1111

    // The Montgomery u-coordinate is derived through the bilinear map
    //
    //     u = (1 + y) / (1 - y)
    //
    // See https://blog.filippo.io/using-ed25519-keys-for-encryption.
    y := new(big.Int).SetBytes(bigEndianY)
    denom := big.NewInt(1)
    denom.ModInverse(denom.Sub(denom, y), curve25519P) // 1 / (1 - y)
    u := y.Mul(y.Add(y, big.NewInt(1)), denom)
    u.Mod(u, curve25519P)

    out := make([]byte, curve25519.PointSize)
    uBytes := u.Bytes()
    for i, b := range uBytes {
       out[len(uBytes)-i-1] = b
    }

    return out
}

func PrivateKeyToCurve25519(curve25519Private *[32]byte, privateKey *[64]byte) {
    h := sha512.New()
    h.Write(privateKey[:32])
    digest := h.Sum(nil)

    digest[0] &= 248
    digest[31] &= 127
    digest[31] |= 64

    copy(curve25519Private[:], digest)
}

func edwardsToMontgomeryX(outX, y *edwards25519.FieldElement) {
    // We only need the x-coordinate of the curve25519 point, which I'll
    // call u. The isomorphism is u=(y+1)/(1-y), since y=Y/Z, this gives
    // u=(Y+Z)/(Z-Y). We know that Z=1, thus u=(Y+1)/(1-Y).
    var oneMinusY edwards25519.FieldElement
    edwards25519.FeOne(&oneMinusY)
    edwards25519.FeSub(&oneMinusY, &oneMinusY, y)
    edwards25519.FeInvert(&oneMinusY, &oneMinusY)

    edwards25519.FeOne(outX)
    edwards25519.FeAdd(outX, outX, y)

    edwards25519.FeMul(outX, outX, &oneMinusY)
}

// PublicKeyToCurve25519 converts an Ed25519 public key into the curve25519
// public key that would be generated from the same private key.
func PublicKeyToCurve25519(curve25519Public *[32]byte, publicKey *[32]byte) bool {
    var A edwards25519.ExtendedGroupElement
    if !A.FromBytes(publicKey) {
       return false
    }

    // A.Z = 1 as a postcondition of FromBytes.
    var x edwards25519.FieldElement
    edwardsToMontgomeryX(&x, &A.Y)
    edwards25519.FeToBytes(curve25519Public, &x)
    return true
}