RFC 8032, "Edwards-Curve Digital Signature Algorithm (EdDSA)", January 2017

Errata ID: 5968
Status: Reported
Type: Technical
Publication Format(s) : TEXT
Reported By: Valeria Nikolaenko
Date Reported: 2020-01-28

Section 3.1 says:

3.1.  Encoding

   An integer 0 < S < L - 1 is encoded in little-endian form as a b-bit
   string ENC(S).

It should say:

3.1.  Encoding

   An integer 0 <= S <= L - 1 is encoded in little-endian form as a b-bit
   string ENC(S).

Notes:

The range of the scalar should include the end-points: 0 and L-1.

Report New Errata