Ristretto is the work of Henry de Valence, co-author of one of the fastest ECC implementations, curve25519-dalek, and it’s a generalization of Decaf by Mike Ham

Ristretto is the work of Henry de Valence, co-author of one of the fastest ECC implementations, curve25519-dalek, and it’s a generalization of Decaf by Mike Hamburg. It’s truly a piece of outstanding cryptography design. Ristretto and Decaf do something awesome: they make a prime order group out of a normal curve with a cofactor. A prime order group is what many higher level constructs expect, and when that expectation breaks you hear about cofactor vulnerabilities, like the Monero double spend. You can tiptoe around cofactors and if you do it exactly right you can survive, but that’s not the kind of safe to use and implement cryptography we’ve been trying to build recently. Ristretto solves that. Decaf can make a prime order group from curves with cofactor 4 (that means order p*4), like Ed448. Ristretto is the generalization that works also on curves with cofactor 8 like Ed25519. And it’s extremely fast.