SPRUJB6B November 2024 – May 2025 AM2612
These commands generate an Ed448 or Ed25519 key, respectively. Internally, EDDSA_KEYGEN performs something like a Curve448 or Curve25519 calculation on the isomorphic or 4-isogenous Montgomery curve, then converts the result to Edwards form.
The conversion can calculate the y-coordinate on the Edwards curve directly. However, it must recover the x-coordinate based on the x-coordinate of a known point on the Edwards curve, given as a “magic” value. The required magic values are given in big-endian hex notation below.
For Ed25519, the magic value is the Edwards x-coordinate of (2259)*generator: 0x 5f217249 cc09cbf9 795d76a5 5ea61345 fe33577f 3b423362 01d1ca05 e501d242
For Ed448, the magic value is the Edwards x-coordinate of (2453)*generator:
0x fb474bf3 baf33016 4d1d9c1f ac2120f3 e60585ac e1de6d9d 2134dcae 16193f95 0c27c6e3 87bb3a63 17b89412 0eded584 2d5a5b99 3dca73f2
| Slot | Name | Description | In ROM? |
|---|---|---|---|
| 2 | Magic | “Magic” x-coordinate, see above. | Yes |
| 3 | s0 | First component of additively-blinded private key. | No |
| 4 | s1 | Second component of additively-blinded private key. | No |
| 12 | gu |
x-coordinate of the Montgomery curve’s generator. Called “gu” as a reminder that it is on the Montgomery curve, since points on a Montgomery curve are often described as (u,v) instead of (x,y). |
Yes |
| 13 | q | The order of the subgroup generated by gu. Must be odd. | Yes |
| 14 | p | Order of the finite field underlying the elliptic curve if it is not a supported special modulus. | Yes |
| 15 | A24 | (A-2)/4 factor of the Montgomery curve | Yes |
This command will raise an error if:
On error, this command clears slots 3 through 12. On success, ED25519_KEYGEN clears slots 5 through 10 and 12, whereas ED448_KEYGEN clears slots 5 through 10.
| Slot | Name | Description |
|---|---|---|
| 3 | s0 | First component of private key, reblinded. |
| 4 | s1 | Second component of private key, reblinded. |
| 11 | pyc | Compressed form of the output public key. |
| 12 | pxs | For Ed448, the high byte of the output public key (always 0x80 or 0x00). |