Module ed448 

Ed448 (RFC 8032 §5.2) — EdDSA over edwards448 (“Goldilocks”).

Untwisted Edwards curve x^2 + y^2 = 1 + d·x^2·y^2 with d = -39081 over GF(2^448 - 2^224 - 1), cofactor 4, hash SHAKE256. Keys are 57 octets, signatures 114 octets.

This module reuses the generic constant-time field arithmetic of super::field (FieldElement<7> over super::field::CURVE448_P, the same prime X448 uses). Curve constants are taken verbatim from the RFC 8032 reference code and were cross-checked by running the RFC’s own [L+1]·B == B self-test (see the commit message / tests below).

Side-channel posture

• The secret scalar multiplication Ed448Point::scalar_mul is a fixed-length MSB→LSB double-and-add: every bit performs one double plus one add and a branchless Ed448Point::ct_select, so the sequence of group operations is independent of the scalar. The underlying field ops are the CT primitives of super::field (mask-select shielded with core::hint::black_box).
• Scalar reduction modulo L (reduce_mod_l) is a fixed-iteration bit-serial long division (no secret-dependent branch or bound).
• decode operates on public data (public keys, the signature’s R), so its is_some/sign branches are not secret-dependent.

[CROSS-CHECK RECOMMENDED] ct_select is an inline mask-select mirroring the existing Fe25519::ct_select in super::eddsa; a future pass may route both through silentops::ct once it exposes a [u64; N] select.

Structs

Ed448Point

A point on edwards448 in projective coordinates (X : Y : Z).

Ed448PublicKey

An Ed448 public key: the 57-octet encoding of [a]B.

Ed448SecretKey

An Ed448 secret key (the 57-octet seed).

Ed448Signature

An Ed448 signature: R || S, 114 octets.

Functions

ed448_keygen

Derive the public key [a]B from a 57-octet secret seed (RFC 8032 §5.2).

ed448_sign

Sign msg with Ed448 (pure, empty context).

ed448_verify

Verify an Ed448 (pure, empty context) signature.

ed448ctx_sign

Sign msg with Ed448 and an explicit context string (len ≤ 255).

ed448ctx_verify

Verify an Ed448 signature made with an explicit context string.

ed448ph_sign

Sign msg with Ed448ph: signs SHAKE256(msg, 64) with hflag = 1.

ed448ph_sign_prehashed

Sign an already-computed 64-octet pre-hash with Ed448ph.

ed448ph_verify

Verify an Ed448ph signature over msg (re-hashes msg with SHAKE256).

ed448ph_verify_prehashed

Verify an Ed448ph signature against an already-computed 64-octet pre-hash.

reduce_mod_l

Reduce an arbitrary little-endian integer modulo L, returning the 57-octet little-endian residue (the high octet is always 0; sized to match the signature’s S field). Fixed-iteration bit-serial long division — constant-time in the number of input bits.