RFC 8032, "Edwards-Curve Digital Signature Algorithm (EdDSA)", January 2017

Errata ID: 5757
Status: Rejected
Type: Technical
Publication Format(s) : TEXT
Reported By: Franck Rondepierre
Date Reported: 2019-06-21
Rejected by: Stanislav Smyshlyaev
Date Rejected: 2021-10-26

Section .1 says:

An element (x,y) of E is encoded as a b-bit string called ENC(x,y),
 which is the (b-1)-bit encoding of y concatenated with one bit that
 is 1 if x is negative and 0 if x is not negative.

It should say:

An element (x,y) of E is encoded as a b-bit string called ENC(x,y),
 which is the (b-1)-bit encoding of y concatenated 
with the least significant bit of x.

Notes:

Section 3.1 is not coherent with encodings described for Ed25519 (5.1.2) and Ed448 (5.2.2)
--VERIFIER NOTES--
The original text was correct (verified by Nick Sullivan).

Report New Errata