Home / The record / EdDSA, the new clause

A new clause defines EdDSA as a mechanism whose verification key is an encoded curve point and whose witness is an encoded multiple of the base point. The message hash includes a domain octet, the witness, the verification key and the message. The second part of the signature is computed from the secret integer, the assignment and the randomizer.

What it asks

Implement EdDSA as a distinct mechanism with its own key encoding, signing and verification path. Record that the verification key is inside the hashed input, because that is the property the introduction note relies on. Record the reference the clause cites and the notation changes it makes.

What the amendment does

Inserts 6.13.1 after 6.12.5.7. So this is new text rather than a change to wording.

Who it binds

The engineer who implements or configures EdDSA, and the reviewer who approves it.

Evidence an auditor samples

• The design note for EdDSA, with the hashed input fields named (architecture)
• The interoperation test against a second implementation (integration report)
• The code review record that names the clause (review log)

The test you can run

Change one byte of the verification key in a valid signature and verify again. If the result does not change, the key is not inside the hashed input.

Common failures

• The library is used as a black box and the hashed input is never inspected.
• The mechanism is added to the list but the signing path still calls a generic elliptic curve routine.

How to close it

The one property to evidence is the binding of the key into the hash, because it is what separates EdDSA from the mechanisms the note warns about. One test that flips a key byte and one that flips a message byte shows both bindings. The decision this clause forces is whether EdDSA enters the approved list, and that decision needs an owner before any code is written. Put the design note for EdDSA, with the hashed input fields named in the register first, then work down the evidence list until every line has a date.

Where it sits against the base standard

The base standard does not carry this text. The amendment adds it, so an estate working from the 2018 edition alone will not find it. The citation has to name the amendment, and the record for 6.13.1 is the only place a reader can see it.