SPRUJB6B November 2024 – May 2025 AM2612
This command begins the process of signing a message with an Ed448 or Ed25519 key. Internally, these commands perform something like a Curve448 or Curve25519 calculation on the isomorphic or 4-isogenous Montgomery curve, then convert the result to Edwards form.
EdDSA calculates nonce*generator, and then hashes that result with the message before continuing. The PKE does not have a hash core, so it instead performs the calculations before the hash in ED448_SIGN_P1 resp. ED25519_SIGN_P2, and the calculations after the hash in ED448_SIGN_P2 resp. ED25519_SIGN_P2.
The ED448_SIGN_P1 and ED25519_SIGN_P1 commands modify the nonce to be in a more usable format. This format is the same one taken by ED448_SIGN_P2 and ED25519_SIGN_P2.
| Slot | Name | Description | In ROM? |
|---|---|---|---|
| 0 | n0 | Less-significant half of the nonce | No |
| 1 | n1 | More-significant half of the nonce | No |
| 2 | Magic | “Magic” value as in ED448_KEYGEN or ED25519_KEYGEN | Yes |
| 3 | s0 | First component of additively-blinded private key. | No |
| 4 | s1 | Second component of additively-blinded private key. | No |
| 5 | n2 | For ED448_SIGN_P1 only: the most-significant 16 bits of the nonce. Must be less than 216. | No |
| 12 | gu | x-coordinate of the Montgomery curve’s generator | Yes |
| 13 | q | The order of the subgroup generated by gu. Must be odd. | Yes |
| 14 | p | Order of the finite field underlying the elliptic curve if it is not a supported special modulus. | Yes |
| 15 | A24 | (A-2)/4 factor of the Montgomery curve | Yes |
This command will raise an error if:
On error, this command clears slots 0 through 12. On success, ED448_SIGN_P1 clears slots 5 through 10, whereas ED25519_SIGN_P1 clears slots 5 through 10 and also 12.
| Slot | Name | Description |
|---|---|---|
| 0 | n0 | First share of modified blinded nonce |
| 1 | n1 | Second share of modified blinded nonce |
| 3 | s0 | First component of private key, reblinded |
| 4 | s1 | Second component of private key, reblinded |
| 11 | r | R-component of signature |
| 12 | rys | For ED448_SIGN_P1 only: most significant 8 bits of R-component of signature |