[shinigami]

> malleability is not one of them, if one is following RFC 8032

This is like claiming Weierstrass curves don't have any problems if you follow the NIST/SECG standards. The whole point of the "SafeCurves" it to be easier to get them right, but you can still get them wrong.

[cryptbe]

If one implements EdDSA, but does not follow RFC 8032, one is doing it wrong on multiple levels.

[loup-vaillant]

Daniel J. Bernstein et al's original paper (High-Speed High-Security Signatures), didn't feel the need to take as many precautions as RFC 8032. For instance, they didn't care about malleability.

You seem to think they should have. May I ask why?

[tptacek]

I'm interested in Thai's response to this question too, as I would be in any comment anyone managed to solicit from him about this topic, but an easy point to make here is that Bernstein was himself involved in RFC 8032, at least as a reviewer and contributor to the process, as you can quickly learn by reading the CFRG mailing list.

[loup-vaillant]

Oh, so DJB changed his mind then? Makes sense considering the application of EdDSA beyond signatures (I've heard malleability is a problem with zero-knowledge proofs, but I haven't studied that subject).

[shinigami]

If one implements ECDSA, but does not follow SECG, one is also doing it wrong on multiple levels. Yet here we are.