diff --git a/src/libsodium/crypto_core/ed25519/core_ed25519.c b/src/libsodium/crypto_core/ed25519/core_ed25519.c
index 02a3e098..2af85409 100644
--- a/src/libsodium/crypto_core/ed25519/core_ed25519.c
+++ b/src/libsodium/crypto_core/ed25519/core_ed25519.c
@@ -82,7 +82,7 @@ _string_to_points(unsigned char * const px, size_t n,
                   const char *ctx, const unsigned char *msg, size_t msg_len)
 {
     crypto_hash_sha512_state st;
-    const unsigned char      empty_block[128] = { 0 };
+    const unsigned char      empty_block[HASH_BLOCKBYTES] = { 0 };
     unsigned char            u0[HASH_BYTES], u[2 * HASH_BYTES];
     unsigned char            t[3] = { 0U, n * HASH_L, 0U};
     unsigned char            ctx_len_u8;
diff --git a/src/libsodium/crypto_core/ed25519/core_ristretto255.c b/src/libsodium/crypto_core/ed25519/core_ristretto255.c
index 80962aa8..babde706 100644
--- a/src/libsodium/crypto_core/ed25519/core_ristretto255.c
+++ b/src/libsodium/crypto_core/ed25519/core_ristretto255.c
@@ -3,7 +3,7 @@
 
 #include "crypto_core_ed25519.h"
 #include "crypto_core_ristretto255.h"
-#include "crypto_hash_sha512.h"
+#include "crypto_hash_sha256.h"
 #include "private/common.h"
 #include "private/ed25519_ref10.h"
 #include "randombytes.h"
@@ -68,52 +68,66 @@ crypto_core_ristretto255_from_hash(unsigned char *p, const unsigned char *r)
     return 0;
 }
 
-#define HASH_BYTES      crypto_hash_sha512_BYTES
-#define HASH_BLOCKBYTES 128U
+#define HASH_BYTES      crypto_hash_sha256_BYTES
+#define HASH_BLOCKBYTES 64U
 #define HASH_L          crypto_core_ristretto255_HASHBYTES
 
 static int
 _string_to_element(unsigned char *p,
                    const char *ctx, const unsigned char *msg, size_t msg_len)
 {
-    crypto_hash_sha512_state st;
-    const unsigned char      empty_block[128] = { 0 };
+    crypto_hash_sha256_state st;
+    const unsigned char      empty_block[HASH_BLOCKBYTES] = { 0 };
     unsigned char            u0[HASH_BYTES];
+    unsigned char            u[2 * HASH_BYTES];
     unsigned char            t[3] = { 0U, HASH_L, 0U};
     unsigned char            ctx_len_u8;
     size_t                   ctx_len = ctx != NULL ? strlen(ctx) : 0U;
+    size_t                   i;
 
+    COMPILER_ASSERT(HASH_L == sizeof u);
     COMPILER_ASSERT(HASH_L <= 0xff);
     if (ctx_len > (size_t) 0xff) {
-        crypto_hash_sha512_init(&st);
-        crypto_hash_sha512_update(&st,
+        crypto_hash_sha256_init(&st);
+        crypto_hash_sha256_update(&st,
                                   (const unsigned char *) "H2C-OVERSIZE-DST-",
                                   sizeof "H2C-OVERSIZE-DST-" - 1U);
-        crypto_hash_sha512_update(&st, (const unsigned char *) ctx, ctx_len);
-        crypto_hash_sha512_final(&st, u0);
+        crypto_hash_sha256_update(&st, (const unsigned char *) ctx, ctx_len);
+        crypto_hash_sha256_final(&st, u0);
         ctx = (const char *) u0;
         ctx_len = HASH_BYTES;
         COMPILER_ASSERT(HASH_BYTES <= (size_t) 0xff);
     }
     ctx_len_u8 = (unsigned char) ctx_len;
-    crypto_hash_sha512_init(&st);
-    crypto_hash_sha512_update(&st, empty_block, sizeof empty_block);
-    crypto_hash_sha512_update(&st, msg, msg_len);
-    crypto_hash_sha512_update(&st, t, 3U);
-    crypto_hash_sha512_update(&st, (const unsigned char *) ctx, ctx_len);
-    crypto_hash_sha512_update(&st, &ctx_len_u8, 1U);
-    crypto_hash_sha512_final(&st, u0);
+    crypto_hash_sha256_init(&st);
+    crypto_hash_sha256_update(&st, empty_block, sizeof empty_block);
+    crypto_hash_sha256_update(&st, msg, msg_len);
+    crypto_hash_sha256_update(&st, t, 3U);
+    crypto_hash_sha256_update(&st, (const unsigned char *) ctx, ctx_len);
+    crypto_hash_sha256_update(&st, &ctx_len_u8, 1U);
+    crypto_hash_sha256_final(&st, u0);
 
     t[2]++;
-    crypto_hash_sha512_init(&st);
-    crypto_hash_sha512_update(&st, u0, HASH_BYTES);
-    crypto_hash_sha512_update(&st, &t[2], 1U);
-    crypto_hash_sha512_update(&st, (const unsigned char *) ctx, ctx_len);
-    crypto_hash_sha512_update(&st, &ctx_len_u8, 1U);
-    crypto_hash_sha512_final(&st, u0);
+    crypto_hash_sha256_init(&st);
+    crypto_hash_sha256_update(&st, u0, HASH_BYTES);
+    crypto_hash_sha256_update(&st, &t[2], 1U);
+    crypto_hash_sha256_update(&st, (const unsigned char *) ctx, ctx_len);
+    crypto_hash_sha256_update(&st, &ctx_len_u8, 1U);
+    crypto_hash_sha256_final(&st, u);
+
+    t[2]++;
+    crypto_hash_sha256_init(&st);
+    for (i = 0; i < HASH_BYTES; i++) {
+        u[32 + i] = u[i] ^ u0[i];
+    }
+    crypto_hash_sha256_update(&st, &u[32], HASH_BYTES);
+    crypto_hash_sha256_update(&st, &t[2], 1U);
+    crypto_hash_sha256_update(&st, (const unsigned char *) ctx, ctx_len);
+    crypto_hash_sha256_update(&st, &ctx_len_u8, 1U);
+    crypto_hash_sha256_final(&st, &u[32]);
 
     COMPILER_ASSERT(crypto_core_ristretto255_HASHBYTES == HASH_L);
-    ristretto255_from_hash(p, u0);
+    ristretto255_from_hash(p, u);
 
     return 0;
 }