Change Details

In EdDSA signature (R,S), S=0 is possible valid value (seeDaniel J. Bernstein et al: https://ed25519.cr.yp.to/ed25519-20110926.pdf). (Wikipedia article is wrong for this, saying 0 < S < l). When GnuPG 2.2/2.3 handles such a signature of Ed25519, it rejects the signature by GPG_ERR_BAD_MPI wrongly. This is quite rare case, but it should be handled correctly. (Note that ECDSA, R != 0 and S !=0 is guaranteed.)

In EdDSA signature (R,S), S=0 is possible valid value (see Daniel J. Bernstein et al: https://ed25519.cr.yp.to/ed25519-20110926.pdf). (Wikipedia article is wrong for this, saying 0 < S < l). When GnuPG 2.2/2.3 handles such a signature of Ed25519, it rejects the signature by GPG_ERR_BAD_MPI wrongly. This is quite rare case, but it should be handled correctly. (Note that ECDSA, R != 0 and S !=0 is guaranteed.)

In EdDSA signature (R,S), S=0 is possible valid value (see Daniel J. Bernstein et al: https://ed25519.cr.yp.to/ed25519-20110926.pdf). (Wikipedia article is wrong for this, saying 0 < S < l). When GnuPG 2.2/2.3 handles such a signature of Ed25519, it rejects the signature by GPG_ERR_BAD_MPI wrongly. This is quite rare case, but it should be handled correctly. (Note that ECDSA, R != 0 and S !=0 is guaranteed.)