EdDSA verifier accepts non-canonical S plus the group order

The EdDSA verifier checks that encoded S has the expected byte length, converts it to an MPI, and immediately multiplies the base point. It never enforces the required scalar range S < L. Because adding the group order does not change S times the base point, a signature can have S replaced by S + L and still verify when the sum fits the encoding.

Vulnerable code

In cipher/ecc-eddsa.c, function _gcry_ecc_eddsa_verify:

_gcry_mpi_set_buffer (s, sbuf, slen, 0);
xfree (sbuf);
if (slen != b)
  {
    rc = GPG_ERR_INV_LENGTH;
    goto leave;
  }
}

_gcry_mpi_ec_mul_point (&Ia, s, ec->G, ec);

Why it matters

The supplied verification harness transformed a valid signature by adding L to S and observed success. This is signature malleability: it breaks systems that treat signature bytes as a unique identifier, use them for deduplication, or key policy decisions on exact encodings. It does not let an attacker sign a different message or forge without an existing valid signature.

Proposed fix

After decoding S and before scalar multiplication, reject S greater than or equal to the curve subgroup order ec->n with a bad-signature error. Add regression vectors for S equal to L, S + L, the largest canonical S, and valid Ed25519 and Ed448 signatures, ensuring noncanonical encodings are rejected consistently.