Home / The record / Annexes changed

Annex B gains the point encoding and decoding for EdDSA. The form is little endian, the other coordinate is written in the set length, and the sign of the first coordinate travels in the top bit of the final octet. The decoding direction is the one the verifier uses, so it is the direction that has to reject.

What it asks

Implement the encoding and the decoding as a pair, and test the decoder against non canonical input, a point not on the curve and a point of small order. The decoder is a trust boundary and should be reviewed as one.

What the amendment does

Adds EdDSA encoding and decoding to Annex B. So the annex keeps its base text and gains this material, which a copy of the base annex will not have.

Who it binds

The implementer of the encoder and the security reviewer.

Evidence an auditor samples

• The encoder and decoder, with one shared test table (source repository)
• The negative decoding cases and their results (test suite)
• The fuzz corpus and the last run date (security testing)

The test you can run

Decode a value whose sign bit is set and whose coordinates are valid, and one whose sign bit is set and whose coordinates are not. Both must be handled, and only the first may be accepted.

Common failures

• The encoder is written from the encoder in another library and the decoder is not.
• The sign bit is masked on the way in and ignored on the way out.

How to close it

Write the encoder and decoder together, from the same table, and fuzz the decoder. The encoder is exercised by every signature, so defects there are found early; the decoder is exercised by attackers, so defects there are found late. Put the encoder and decoder, with one shared test table in the register first, then work down the evidence list until every line has a date.

Where it sits against the base standard

The annex exists in the base standard and the amendment extends it. A copy of the base annex is not the current annex, so the citation must name the amendment as well as the edition.