Home / The record / EdDSA, the new clause

The witness is the encoding of the pre-signature point. The clause applies the same encoding steps as the verification key: the other coordinate is written little endian in the set length, the top bit of the last octet is left clear, and the lowest bit of the first coordinate is copied into that bit.

What it asks

Encode the witness with the rules that apply to the verification key, and test the bit that carries the sign. A witness that drops the sign bit verifies for some inputs and fails for others, which is the worst kind of defect to find in production.

What the amendment does

Inserts 6.13.4.4. So this is new text rather than a change to wording.

Who it binds

The signing implementation owner and the test owner.

Evidence an auditor samples

• The encoder, shared by the key and the witness paths (source repository)
• The sign bit test, covering both values of the bit (test suite)
• The interoperation record with a second implementation (integration report)

The test you can run

Find an input whose pre-signature has the sign bit set, and verify it. If the signature fails, the bit is not being carried.

Common failures

• Two encoders exist, one for keys and one for witnesses.
• The sign bit is set from the wrong coordinate.

How to close it

Share one encoder between keys and witnesses, and test it with a value that exercises both states of the sign bit. A shared encoder removes the class of defect where one path is fixed and the other is forgotten. Put the encoder, shared by the key and the witness paths in the register first, then work down the evidence list until every line has a date.

Where it sits against the base standard

The base standard does not carry this text. The amendment adds it, so an estate working from the 2018 edition alone will not find it. The citation has to name the amendment, and the record for 6.13.4.4 is the only place a reader can see it.