Using a single Ed25519 key for encryption and signature The libsodium documentation contains a function crypto_sign_ed25519_pk_to_curve25519 that converts an Ed25519 key into a Curve25519 one, so it can be used for both key exchange/encryption and signing:

"Ed25519 keys can be converted to Curve25519 keys, so that the same key pair can be used both for authenticated encryption (crypto_box) and for signatures (crypto_sign)."

The same page ends "Notes: If you can afford it, using distinct keys for signing and for encryption is still highly recommended."

My question is whether reusing an Ed25519 keypair for both uses has been proven secure anywhere, for example in the sense of Joint Security of Encryption and Signature or a similar paper?

The two constructions seem to be:


EdDSA signature (i.e. "Schnorr signature done properly")
Ephemeral DH key exchange using a one-time keypair on the sender side and the recipient's public key (mapped to Curve25519).


Both involve a one-time ephemeral keypair and a hash function, I'm fine with the random oracle model (so we can assume the EdDSA nonce, which is actually a function of the key and message, is really random) and one can get domain separation by including a separation tag in the key exchange, i.e. when Alice wants to send a file to Bob whose public key is Q, she picks a pair (r, r.P) and sets the key as k = H(r.Q, "this is a key not a signature") or something similar.

Intuitively this should be fine in the random oracle model; has someone actually (dis)proved it though?
The paper On the Joint Security of Encryption and Signature in EMV is very close. Section 4.4, "On the Joint Security of ECIES and EC-Schnorr", states the following result:


  Theorem 2. In the random oracle model ECIES-KEM and EC-Schnorr are jointly secure if the gap-DLP problem and gap-DH problem are both hard.


Obviously, this does not apply to EdDSA/DH out of the box: ECIES is a certain application of Diffie-Hellman, and EdDSA is a slightly modified variant of elliptic-curve Schnorr signatures.
However, the proof sketches in the paper should be easily adaptable to EdDSA combined with any other reasonable Diffie-Hellman incarnation. (The details of this depend a little on how the DH shared secret is used for symmetric (authenticated) encryption, but it seems possible to modify the proof for all realistic settings.)