# 6.13.4.4 The witness is an encoded point

The witness is the encoding of the pre-signature point. The clause applies the same encoding steps as the verification key: the other coordinate is written little endian in the set length, the top bit of the last octet is left clear, and the lowest bit of the first coordinate is copied into that bit.

## What it asks

Encode the witness with the rules that apply to the verification key, and test the bit that carries the sign. A witness that drops the sign bit verifies for some inputs and fails for others, which is the worst kind of defect to find in production.

## What the amendment does

Inserts 6.13.4.4.

## Who it binds

The signing implementation owner and the test owner.

## Evidence an auditor samples

- The encoder, shared by the key and the witness paths (source repository)
- The sign bit test, covering both values of the bit (test suite)
- The interoperation record with a second implementation (integration report)

## The test you can run

Find an input whose pre-signature has the sign bit set, and verify it. If the signature fails, the bit is not being carried.

## Common failures

- Two encoders exist, one for keys and one for witnesses.
- The sign bit is set from the wrong coordinate.

## How to close it

Share one encoder between keys and witnesses, and test it with a value that exercises both states of the sign bit. A shared encoder removes the class of defect where one path is fixed and the other is forgotten.

## Source

ISO/IEC 14888-3:2018/FDAM 1:2026(en), draft, 6.13.4.4. Read on 21 October 2026. Our wording, not the instrument's.
https://www.iso.org/standard/89517.html

Not legal advice; does not certify.