Home / The record / EdDSA, the new clause

The second part of the signature is computed from the secret integer, the assignment and the randomizer, reduced modulo the order of the base point, and written little endian in the set length. The clause fixes how many high bits of the final octets are always clear for each set.

What it asks

Encode the second part in the fixed length and assert that the unused high bits are clear. A decoder that ignores the unused bits will accept two encodings of the same value, which breaks any system that treats the signature bytes as an identifier.

What the amendment does

Inserts 6.13.4.6. So this is new text rather than a change to wording.

Who it binds

The signing implementation owner and any system that stores signatures as identifiers.

Evidence an auditor samples

• The encoded signature length test for both sets (test suite)
• The assert that unused high bits are clear (source repository)
• The storage schema, showing the signature is not used as a unique key (data model)

The test you can run

Take a valid signature and set one unused high bit. A verifier that accepts it is not checking the encoding.

Common failures

• The signature is truncated and the length is not asserted.
• A database uses the signature bytes as a primary key.

How to close it

Fixed length encodings invite truncation. Assert the length, assert the unused bits, and keep signatures out of primary keys, because two encodings of one value are a duplicate key waiting to happen. The artefact that opens the work is the encoded signature length test for both sets; the row is only closed when that artefact is dated and has a person against it.

Where it sits against the base standard

The base standard does not carry this text. The amendment adds it, so an estate working from the 2018 edition alone will not find it. The citation has to name the amendment, and the record for 6.13.4.6 is the only place a reader can see it.