RFC8032 Edwards-Curve Digital Signature Algorithm (EdDSA) 5.1.3 Decoding states the following:
Decoding a point, given as a 32-octet string, is a little more
- First, interpret the string as an integer in little-endian representation. Bit 255 of this number is the least significant bit of the x-coordinate and denote this value x_0. The y-coordinate is recovered simply by clearing this bit. If the resulting value is >= p, decoding fails.
My questions are...
32 octets is 256 bits. I'm assuming the index of the first bit is 0 instead of 1, which would make 255 the last bit. So why not say that it's the last bit instead of the 255'th bit?
Quoting the previous section, "To form the encoding of the point, copy the least significant bit of the x-coordinate to the most significant bit of the final octet.". So to encode we set the most significant bit and to decode we look at the least significant bit? So we're not looking at the same bit? That doesn't make a lot of sense to me.
When you interpret the string as an integer I'm assuming you're supposed to interpret it in two's compliment? eg. where if the first bit is 1 then you assume that the number is negative? The RFC isn't at all clear imho..