5.2 Ed448ph and Ed448
5.2 Ed448ph and Ed448
Ed448 is EdDSA instantiated with:
Table 2: Parameters of Ed448
| Parameter | Value |
|---|---|
| p | p of edwards448 in [RFC7748] (i.e., 2^448 - 2^224 - 1) |
| b | 456 |
| encoding of GF(p) | 455-bit little-endian encoding of {0, 1, ..., p-1} |
| H(x) | SHAKE256(dom4(phflag,context)||x, 114) |
| phflag | 0 |
| c | base 2 logarithm of cofactor of edwards448 in [RFC7748] (i.e., 2) |
| n | 447 |
| d | d of edwards448 in [RFC7748] (i.e., -39081) |
| a | 1 |
| B | (X(P),Y(P)) of edwards448 in [RFC7748] (i.e., (2245800402959243001876043340998960362467896416325641342461254616869504154674060329090291928679537953282578032075146446173674602635247710, 298819210078481492676017930443930673437544040154080242095928241372331506189876003536878655418784733982303233503462500531545062832660)) |
| L | order of edwards448 in [RFC7748] (i.e., 2^446 - 138180668098951153520073867485154268803366924748821789894547503885) |
| PH(x) | x (i.e., the identity function) |
Ed448ph is the same but with PH being SHAKE256(x, 64) and phflag being 1, i.e., the input is hashed before signing with Ed448 with a hash constant modified.
Value of context is set by signer and verifier (maximum of 255 octets; the default is empty string) and has to match octet by octet for verification to be successful.
The curve is equivalent to Ed448-Goldilocks under change of the basepoint, which preserves difficulty of the discrete logarithm.