2. Notation and Conventions

2. Notation and Conventions

The following notation is used throughout the document:

p - Denotes the prime number defining the underlying field

GF(p) - Finite field with p elements

x^y - x multiplied by itself y times

B - Generator of the group or subgroup of interest

[n]X - X added to itself n times

h[i] - The i'th octet of octet string

h_i - The i'th bit of h

a || b - (bit-)string a concatenated with (bit-)string b

a <= b - a is less than or equal to b

a >= b - a is greater than or equal to b

i+j - Sum of i and j

i*j - Multiplication of i and j

i-j - Subtraction of j from i

i/j - Division of i by j

i x j - Cartesian product of i and j

(u,v) - Elliptic curve point with x-coordinate u and y-coordinate v

SHAKE256(x, y) - The y first octets of SHAKE256 [FIPS202] output for input x

OCTET(x) - The octet with value x

OLEN(x) - The number of octets in string x

dom2(x, y) - The blank octet string when signing or verifying Ed25519. Otherwise, the octet string: "SigEd25519 no Ed25519 collisions" || octet(x) || octet(OLEN(y)) || y, where x is in range 0-255 and y is an octet string of at most 255 octets. "SigEd25519 no Ed25519 collisions" is in ASCII (32 octets).

dom4(x, y) - The octet string "SigEd448" || octet(x) || octet(OLEN(y)) || y, where x is in range 0-255 and y is an octet string of at most 255 octets. "SigEd448" is in ASCII (8 octets).

Parentheses (i.e., '(' and ')') are used to group expressions, in order to avoid having the description depend on a binding order between operators.

Bit strings are converted to octet strings by taking bits from left to right, packing those from the least significant bit of each octet to the most significant bit, and moving to the next octet when each octet fills up. The conversion from octet string to bit string is the reverse of this process; for example, the 16-bit bit string

b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11 b12 b13 b14 b15

is converted into two octets x0 and x1 (in this order) as

x0 = b7*128+b6*64+b5*32+b4*16+b3*8+b2*4+b1*2+b0
x1 = b15*128+b14*64+b13*32+b12*16+b11*8+b10*4+b9*2+b8

Little-endian encoding into bits places bits from left to right and from least significant to most significant. If combined with bit-string-to-octet-string conversion defined above, this results in little-endian encoding into octets (if length is not a multiple of 8, the most significant bits of the last octet remain unused).

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].