Home / The record / EdDSA, the new clause

The signing entity hashes a domain octet, the witness, the verification key and the message, reads the digest as a little endian integer and reduces it modulo the order of the base point. The result is the assignment, and it is where the verification key enters the signed data.

What it asks

Compute the assignment with the exact field order and the exact domain octet, and reduce modulo the order of the base point. Record the field order in the design note, because a transposition produces signatures that verify locally and fail everywhere else.

What the amendment does

Inserts 6.13.4.5. So this is new text rather than a change to wording.

Who it binds

The signing implementation owner.

Evidence an auditor samples

• The hash input construction, with the field order written down (design note)
• The test that changes one field at a time (test suite)
• The worked example comparison (test suite)

The test you can run

Swap two fields in the hash input and verify. The signature should fail. If it still verifies, the fields are not both in the hash.

Common failures

• The domain octet is omitted because the library supplies one internally.
• The digest is read big endian.

How to close it

Write the hash input as a formula in the design note and keep it next to the code. The formula is short, and it is the one place where a one field mistake is invisible until two implementations meet. Start with the hash input construction, with the field order written down and let the row close when it exists with a date and a named holder.

Where it sits against the base standard

The base standard does not carry this text. The amendment adds it, so an estate working from the 2018 edition alone will not find it. The citation has to name the amendment, and the record for 6.13.4.5 is the only place a reader can see it.