edの

// https://blog.filippo.io/using-ed25519-keys-for-encryption/

func ed25519PrivateKeyToCurve25519(pk ed25519.PrivateKey) []byte {
    h := sha512.New()
    _, _ = h.Write(pk.Seed())
    out := h.Sum(nil)
    return out[:curve25519.ScalarSize]
}

var curve25519P, _ = new(big.Int).SetString("57896044618658097711785492504343953926634992332820282019728792003956564819949", 10)

func ed25519PublicKeyToCurve25519(pk ed25519.PublicKey) []byte {
    // ed25519.PublicKey is a little endian representation of the y-coordinate,
    // with the most significant bit set based on the sign of the x-coordinate.
    bigEndianY := make([]byte, ed25519.PublicKeySize)
    for i, b := range pk {
       bigEndianY[ed25519.PublicKeySize-i-1] = b
    }
    bigEndianY[0] &= 0b0111_1111

    // The Montgomery u-coordinate is derived through the bilinear map
    //
    //     u = (1 + y) / (1 - y)
    //
    // See https://blog.filippo.io/using-ed25519-keys-for-encryption.
    y := new(big.Int).SetBytes(bigEndianY)
    denom := big.NewInt(1)
    denom.ModInverse(denom.Sub(denom, y), curve25519P) // 1 / (1 - y)
    u := y.Mul(y.Add(y, big.NewInt(1)), denom)
    u.Mod(u, curve25519P)

    out := make([]byte, curve25519.PointSize)
    uBytes := u.Bytes()
    for i, b := range uBytes {
       out[len(uBytes)-i-1] = b
    }

    return out
}

func PrivateKeyToCurve25519(curve25519Private *[32]byte, privateKey *[64]byte) {
    h := sha512.New()
    h.Write(privateKey[:32])
    digest := h.Sum(nil)

    digest[0] &= 248
    digest[31] &= 127
    digest[31] |= 64

    copy(curve25519Private[:], digest)
}

func edwardsToMontgomeryX(outX, y *edwards25519.FieldElement) {
    // We only need the x-coordinate of the curve25519 point, which I'll
    // call u. The isomorphism is u=(y+1)/(1-y), since y=Y/Z, this gives
    // u=(Y+Z)/(Z-Y). We know that Z=1, thus u=(Y+1)/(1-Y).
    var oneMinusY edwards25519.FieldElement
    edwards25519.FeOne(&oneMinusY)
    edwards25519.FeSub(&oneMinusY, &oneMinusY, y)
    edwards25519.FeInvert(&oneMinusY, &oneMinusY)

    edwards25519.FeOne(outX)
    edwards25519.FeAdd(outX, outX, y)

    edwards25519.FeMul(outX, outX, &oneMinusY)
}

// PublicKeyToCurve25519 converts an Ed25519 public key into the curve25519
// public key that would be generated from the same private key.
func PublicKeyToCurve25519(curve25519Public *[32]byte, publicKey *[32]byte) bool {
    var A edwards25519.ExtendedGroupElement
    if !A.FromBytes(publicKey) {
       return false
    }

    // A.Z = 1 as a postcondition of FromBytes.
    var x edwards25519.FieldElement
    edwardsToMontgomeryX(&x, &A.Y)
    edwards25519.FeToBytes(curve25519Public, &x)
    return true
}

https://github.com/succinctlabs

Performance comparison with other zkVMs:

Program	# of Cycles	SP1 Proof Time (s)	SP1 Verification Time (s)	Risc0 Proof Time (s)	Risc0 Verification Time (s)
Fibonacci	1.78M	30 sec: 5.4x ⚡	346 ms	163 sec	163 ms
SSZ Merkle Proofs Verification	3.7M	49 sec: 4.6x ⚡	744 ms	229 sec	268 ms
Tendermint ZK Light Client	31M (SP1) /114M (Risc0)	278 sec (4.6 mins): 28x ⚡	4795 ms	7920 sec (2.2 hours)	7918 ms

Performance comparison with circuits:

Program	SP1 Proof Time	Development Time with SP1	Circuit Proof Time	Circuit Development Time
SSZ Merkle Proof Verification	49 secs	1 afternoon	270 secs	2 months
Tendermint ZK Light Client	278 secs	1 afternoon	300 secs	4 months

curve25519-dalek = { git = "https://github.com/sp1-patches/curve25519-dalek", tag = "patch-4.1.3-sp1-5.0.0" }
curve25519-dalek-ng = { git = "https://github.com/sp1-patches/curve25519-dalek-ng", tag = "patch-4.1.1-sp1-5.0.0" } 
secp256k1 = { git = "https://github.com/sp1-patches/rust-secp256k1", tag = "patch-0.29.1-sp1-5.0.0" }
tiny-keccak = { git = "https://github.com/sp1-patches/tiny-keccak", tag = "patch-2.0.2-sp1-4.0.0" }
substrate-bn = { git = "https://github.com/sp1-patches/bn", tag = "patch-0.6.0-sp1-5.0.0" }
bls12_381 = { git = "https://github.com/sp1-patches/bls12_381", tag = "patch-0.8.0-sp1-5.0.0" }