SPRUJB6B November 2024 – May 2025 AM2612
This command finishes the process of signing with Ed25519.
| Slot | Name | Description | In ROM? |
|---|---|---|---|
| 0 | n0 | First share of modified blinded nonce, as output by ED*_SIGN_P1 | No |
| 1 | n1 | Second share of modified blinded nonce, as output by ED*_SIGN_P1 | No |
| 2 | c0 | Less significant half of the challenge. | No |
| 3 | s0 | First component of additively-blinded private key | No |
| 4 | s1 | Second component of additively-blinded private key | No |
| 5 | c1 | More-significant half of the challenge | No |
| 6 | c2 | For ED448_SIGN_P2, the most-significant 16 bits of the challenge. Must be < 216. | No |
| 13 | q | The order of the subgroup generated by gu. Must be odd. | Yes |
This command will raise an error if:
On error, this command clears slots 0 through 12. On success, ED448_SIGN_P2 clears slots 1,2 and 6 through 10, and ED25519_SIGN_P2 clears slots 1,2 and 5 through 10.
| Slot | Name | Description |
|---|---|---|
| 3 | s0 | First component of private key, reblinded |
| 4 | s1 | Second component of private key, reblinded |
| 5 | s | s-component of signature |
| Slot | Name | Description |
|---|---|---|
| 3 | s0 | First component of private key, reblinded |
| 4 | s1 | Second component of private key, reblinded |
| 12 | s | s-component of signature |
The output maps differ because the ED448 commands use slot 12 for the last byte of the r-component.
These commands do not use slot 11 (used for the r-component of the signature) as either input or output, nor does it erase that slot. Furthermore, ED448_SIGN_P2 does not erase slot 12. So, it is safe to run it directly after EDDSA_SIGN_P1 (after hashing to create the challenge), and to collect (r,s) from memory only afterward.