[hdevalence]

It’s not strange at all. The “all zero public key” is the encoding of the zero element (identity element) of the group. Finding the private key corresponding to a public key A is finding the number a so that A = a*B. When A = 0, this is really easy: a = 0.

[xurukefi]

It's strange if you come from Weierstrasser curves and think of public keys as points on the curve, which I think is what most people start with. I was obviously oversimplifying heavily.

[less_less]

It's still a point on a curve here. It's just on a twisted Edwards curve (or in the case of Ristretto, on a Jacobi quartic curve), not on a Weierstrass curve, but it's the same idea.

When encoding the public key, you give only one coordinate and possibly also a sign bit, and the other person uses the curve equation to solve for the other coordinate. Just like with a Weierstrass curve y^2 = x^3 + ax + b, you can solve for y using only x, plus one bit to say whether to take the positive or negative square root.

Technically, the zero-string encodes the identity element (0,1) for Ristretto, but not for Ed25519 where it's the point (i,0) where i = sqrt(-1). (Not (1,0) as the StackExchange claims, unless I'm very much mistaken. For Ed448 instead I believe it encodes (-1,0).) However the points (i,0) or (-1,0) are basically a rotation of (0,1). So for some protocols it works out that you can use 0 as the private key and it will work anyway.

Part of the point of Ristretto is to eliminate this sort of "gotcha" where certain public keys are equivalent. The way around it is that you pick a certain one of the equivalent points to encode, in a canonical way, and the other options are not valid encodings. This also means you don't need a sign bit: one of the criteria for choosing which rotation is that the sign bit would be zero.

[tptacek]

It's "Weierstrass". I don't believe they're describing a different model of public keys. The private key in all of these schemes is a scalar.