Are EdDSA algorithms encoded by ASN.1 DER standards?

Question

Is it required, or widely practiced to encode a EdDSA signature as a ASN.1 Sequence? Why or why not? How should you encode a EdDSA signature? I cannot find mention of DER or ASN in the EdDSA RFC.

However, there is mention in the ECDSA RFC (as expected)

An ECDSA signature is a pair of integers. In many protocols that require a signature to be a sequence of bits (or octets), it is customary to encode the signature as an ASN.1 SEQUENCE of two INTEGER values, with DER rules.

Answer 1

An EdDSA signature is a sequence of bytes encoded according to the EdDSA paper or its extension to more curves, or according to RFC 8032, which should be treated as opaque by callers.

In particular, for an instance of EdDSA on a curve $E$ over a field $\mathbb F_p$ of order $p < 2^{b-1}$:

• A public key is a $b$-bit bit string $n \mathbin\| \underline y$ encoding a point $(x, y) \in E$, where $n$ is 1 if $x$ is ‘negative’ and 0 if not, and $\underline y$ is the little-endian encoding of the least nonnegative integer residue of $y \in \mathbb F_p$. Here ‘negative’ means $\underline x$ is lexicographically larger than $\underline{-x}$.
• A signature is a $2b$-bit string $\underline R \mathbin\| \underline s$ encoding a point $R \in E$ like a public key, and a $b$-bit integer $s$ in little-endian encoding $\underline s$.

There is no ASN.1 formatting involved here. Forget ASN.1, and forget ECDSA. They are evil things.