# Annex B Point encoding and decoding for EdDSA

Annex B gains the point encoding and decoding for EdDSA. The form is little endian, the other coordinate is written in the set length, and the sign of the first coordinate travels in the top bit of the final octet. The decoding direction is the one the verifier uses, so it is the direction that has to reject.

## What it asks

Implement the encoding and the decoding as a pair, and test the decoder against non canonical input, a point not on the curve and a point of small order. The decoder is a trust boundary and should be reviewed as one.

## What the amendment does

Adds EdDSA encoding and decoding to Annex B.

## Who it binds

The implementer of the encoder and the security reviewer.

## Evidence an auditor samples

- The encoder and decoder, with one shared test table (source repository)
- The negative decoding cases and their results (test suite)
- The fuzz corpus and the last run date (security testing)

## The test you can run

Decode a value whose sign bit is set and whose coordinates are valid, and one whose sign bit is set and whose coordinates are not. Both must be handled, and only the first may be accepted.

## Common failures

- The encoder is written from the encoder in another library and the decoder is not.
- The sign bit is masked on the way in and ignored on the way out.

## How to close it

Write the encoder and decoder together, from the same table, and fuzz the decoder. The encoder is exercised by every signature, so defects there are found early; the decoder is exercised by attackers, so defects there are found late.

## Source

ISO/IEC 14888-3:2018/FDAM 1:2026(en), draft, Annex B. Read on 21 October 2026. Our wording, not the instrument's.
https://www.iso.org/standard/89517.html

Not legal advice; does not certify.