SPRUJB6B November 2024 – May 2025 AM2612
These commands verify EdDSA signatures.
Unlike ED25519_KEYGEN and ED25519_SIGN, these command uses points in Edwards format internally, so ED25519_VERIFY takes inputs (gy,gx,d) instead of (gu,magic,a24). Because for Ed448, d = -a24, the ED448_VERIFY command takes a24 (i.e. -d) instead of d.
For internal reasons, these commands differ in their strictness. The ED25519_VERIFY command verifies the strict equation R = response*G - challenge*P, whereas ED448_VERIFY verifies the lax equation 4R = 4*(response*G – challenge*P). This behavior is permitted per RFC 8032.
| Slot | Name | Description | In ROM? |
|---|---|---|---|
| 0 | pyc | Compressed public key to be used for verification. | No |
| 1 | Pxs | (Ed448 only) Last byte of EdDSA public key, containing either 0x80 or 0x00 depending on the sign of x | No |
| 2 | c0 | Less significant half of the challenge = Hash(R,A,M). | No |
| 3 | r | r-component of the signature | No |
| 4 | s | s-component of the signature | No |
| 5 | c1 | More significant half of the challenge. | No |
| 6 | c2 | (Ed448 only) Most significant 16-bits of the challenge. Must be < 216. | No |
| 7 | rxs | (Ed448 only) Last byte of the signature’s r-component, containing either 0x80 or 0x00 depending on the sign of x | No |
| 10 | i | (Ed25519 only) Any square root of -1 mod p. | Yes |
| 11 | gy | The y-coordinate of the generator on the Edwards curve | Yes |
| 12 | gx | The x-coordinate of the generator on the Edwards curve | Yes |
| 13 | q | The order of the subgroup generated by gu. Must be odd. | Yes |
| 14 | p | Order of the finite field underlying the elliptic curve if it is not a supported special modulus. | Yes |
| 15 | d | For ED25519_VERIFY, the d-coefficient of the Edwards curve. For ED448_VERIFY, -d = a24 = 39081. | Yes |
This command will raise an error if:
On error, this command clears slots 5 through 10. On success, it clears slots 0 through 2, 5 through 10 and 12.
| Slot | Name | Description |
|---|---|---|
| 3 | r | r-component of the signature, preserved. |
| 11 | r' | A value equal to r. Preserved so that software can use it as a fault countermeasure. |