Home / The record / EdDSA, the new clause

The clause specifies how the signature key and the verification key are produced. A random or pseudo random bit string of the set length is hashed into a buffer, the buffer is clamped by rules that differ between the two sets, the secret integer is taken from the first half, and the verification key is the encoding of the secret integer times the base point.

What it asks

Generate the key material from a source fit for a long lived signing key, apply the clamping rule of the set in use, and store the secret integer so that it cannot be exported in clear. Test the public key encoding, including the bit that carries the sign of the other coordinate.

What the amendment does

Inserts 6.13.3. So this is new text rather than a change to wording.

Who it binds

The key custodian and the platform owner.

Evidence an auditor samples

• The key ceremony record, naming the source of randomness and the set (key management)
• The public key encoding test, including the sign bit (test suite)
• The key storage configuration, showing the export control (HSM or key store)

The test you can run

Export a public key and decode it. If the decoder needs a rule that is not in the clause, or the sign bit is dropped, the encoding is not the one specified.

Common failures

• One clamping routine is used for both sets.
• The key is generated once in a test environment and copied to production.

How to close it

Key generation is the step where a small difference between the sets becomes an interoperability failure. Record the set, the clamping rule and the encoding test on one page, and keep it with the ceremony record. The artefact that opens the work is the key ceremony record, naming the source of randomness and the set; the row is only closed when that artefact is dated and has a person against it.

Where it sits against the base standard

The base standard does not carry this text. The amendment adds it, so an estate working from the 2018 edition alone will not find it. The citation has to name the amendment, and the record for 6.13.3 is the only place a reader can see it.