Schnorr NIZK over Ed25519 I am trying to implement the following Schnorr non-interactive zero-knowledge protocol: https://tools.ietf.org/html/rfc8235#page-7

I'm using the libsodium 1.0.16 and GNU MP libraries. 

I just can't seem to get it working. Here are some questions:

    In the setup of the scheme, Alice publishes her public key
    A = G x [a], where a is the private key chosen uniformly at random
    from [1, n-1].

    The protocol works in three passes:

   1.  Alice chooses a number v uniformly at random from [1, n-1] and
       computes V = G x [v].  She sends V to Bob.

   2.  Bob chooses a challenge c uniformly at random from [0, 2^t-1],
       where t is the bit length of the challenge (say, t = 80).  Bob
       sends c to Alice.

   3.  Alice computes r = v - a * c mod n and sends it to Bob.    

   At the end of the protocol, Bob performs the following checks.  If
   any check fails, the verification is unsuccessful.

   1.  To verify A is a valid point on the curve and A x [h] is not the
       point at infinity;

   2.  To verify V = G x [r] + A x [c].


Regarding step (3) on the computation of r = v - a * c mod n it means that this step is using regular modular arithmetic? 

Regarding step (2) on the verification V = G x [r] + A x [c], can you please explain how that would hold? Is the following equivalent: V = ed25519_scalarmult(r, ED25519-BASE) + ed25519_scalarmult(c, A) where ed25519_scalarmult(scalar, point i.e. publickey)? And most importantly that + is Ed25519 point addition?
Regarding step (3) on the computation of r = v - a * c mod n it
  means that this step is using regular modular arithmetic?


Yes.


  Is the following equivalent: V = ed25519_scalarmult(r, ED25519-BASE) +
  ed25519_scalarmult(c, A) [...]?


Yes, see also section 1.2 (near the end) where it says "P x [b]: multiplication of a point P with a scalar b over E(Fp)".


  And most importantly that + is Ed25519 point addition?


Yes, that is indeed the case, + represents the group operation here, which is modular-reduced multiplication for the finite field and point-addition for the EC case. This can be seen when looking at section 2.2.


  V = G x [r] + A x [c], can you please explain how that would hold?


I'll use a slightly more tense notation ($\xleftarrow{\$}$ means that the variable on the left is sampled uniformly at random from the set on the right). 


Pick and publish your public key $A=[a]G$ with $a\xleftarrow{\$}\{1,...,n-1\}$
Pick $v\xleftarrow{\$}\{1,...,n-1\}$, send $V=[v]G$.
Pick $c\xleftarrow{\$}\{1,..,2^t-1\}$, for some security parameter $t$, send $c$
Compute $r=v-a\cdot c\bmod n$ and send $r$.


Now the question is why $V=[r]G+[c]A$ holds in an honest protocol execution. Well $$[c]A+[r]G=[c\cdot a]G+[v-a\cdot c]G=[c\cdot a+v-a\cdot c]G=[v]G=V$$