Home / The record / EdDSA, the new clause

The verifier retrieves the witness and the second part, decodes the verification key and the witness to curve points, and decodes the second part to an integer in range. If a decoding fails or a value is out of range, the signature is rejected. The decode happens before the group equation.

What it asks

Decode the three values, range check them and reject before doing any group arithmetic. Record the rejection cases as named tests, including a non canonical point, a point not on the curve, a value at the order and a value above it. This is the clause that decides whether a malformed signature can be treated as valid.

What the amendment does

Inserts 6.13.5.2. So this is new text rather than a change to wording.

Who it binds

The verifier owner and the test owner.

Evidence an auditor samples

• The named rejection tests, one per case (test suite)
• The verifier code path, showing rejection before the equation (source repository)
• The fuzz run that found no accepted malformed input (security testing)

The test you can run

Present a point that is not on the curve, a non canonical encoding and a value at the order. All three must be rejected.

Common failures

• The decode error is caught and the signature is treated as valid for legacy compatibility.
• A value at the order is accepted because the check uses a strict less than in one place and not another.

How to close it

This clause is the one an attacker reads first. Make the rejection path a single function with named cases, test it directly rather than through the full verify, and keep a fuzz corpus that grows with every finding. The artefact that opens the work is the named rejection tests, one per case; the row is only closed when that artefact is dated and has a person against it.

Where it sits against the base standard

The base standard does not carry this text. The amendment adds it, so an estate working from the 2018 edition alone will not find it. The citation has to name the amendment, and the record for 6.13.5.2 is the only place a reader can see it.