Another potentially silly question here, but I seem to have developed tunnel vision and I am missing something very basic.
In RFC 8032 one can find a number of test vectors for Ed488 - for example:
SECRET KEY: c4eab05d357007c632f3dbb48489924d 552b08fe0c353a0d4a1f00acda2c463a fbea67c5e8d2877c5e3bc397a659949e f8021e954e0a12274e PUBLIC KEY: 43ba28f430cdff456ae531545f7ecd0a c834a55d9358c0372bfa0c6c6798c086 6aea01eb00742802b8438ea4cb82169c 235160627b4c3a9480 MESSAGE (length 1 byte): 03 SIGNATURE: 26b8f91727bd62897af15e41eb43c377 efb9c610d48f2335cb0bd0087810f435 2541b143c4b981b7e18f62de8ccdf633 fc1bf037ab7cd779805e0dbcc0aae1cb cee1afb2e027df36bc04dcecbf154336 c19f0af7e0a6472905e799f1953d2a0f f3348ab21aa4adafd1d234441cf807c0 3a00
The public key, in the encoded format, is 57 bytes in size. Now my understanding is that the public key is obtained by computing the scalar product of the private key (encoded as described in RFC 8032) times the base point. The operations are to be carried out mod the prime p = 2^448 - 2^224 - 1, which is 56 bytes long.
How can the public key be 57 bytes long, if all the operations are mod a 56 bytes long quantity? It is true that the public key is not directly the scalar product above, for this product has to be encoded as described in RFC 8032. However, this encoding is very straightforward, and can't add an extra byte.
I must be missing something very obvious here - but I can't see what it is.