Is it required, or widely practiced to encode a EdDSA signature as a ASN.1 Sequence? Why or why not? How should you encode a EdDSA signature? I cannot find mention of DER or ASN in the EdDSA RFC.

However, there is mention in the ECDSA RFC (as expected)

An ECDSA signature is a pair of integers. In many protocols that require a signature to be a sequence of bits (or octets), it is customary to encode the signature as an ASN.1 SEQUENCE of two INTEGER values, with DER rules.


An EdDSA signature is a sequence of bytes encoded according to the EdDSA paper or its extension to more curves, or according to RFC 8032, which should be treated as opaque by callers.

In particular, for an instance of EdDSA on a curve $E$ over a field $\mathbb F_p$ of order $p < 2^{b-1}$:

  • A public key is a $b$-bit bit string $n \mathbin\| \underline y$ encoding a point $(x, y) \in E$, where $n$ is 1 if $x$ is ‘negative’ and 0 if not, and $\underline y$ is the little-endian encoding of the least nonnegative integer residue of $y \in \mathbb F_p$. Here ‘negative’ means $\underline x$ is lexicographically larger than $\underline{-x}$.
  • A signature is a $2b$-bit string $\underline R \mathbin\| \underline s$ encoding a point $R \in E$ like a public key, and a $b$-bit integer $s$ in little-endian encoding $\underline s$.

There is no ASN.1 formatting involved here. Forget ASN.1, and forget ECDSA. They are evil things.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.