{"record":{"id":"06c438f35ef2ab0d","repo":"golang/go","slug":"ed25519-invalid-signature","errorCode":null,"errorMessage":"ed25519: invalid signature","messagePattern":"ed25519: invalid signature","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/fips140/ed25519/ed25519.go","lineNumber":296,"sourceCode":"}\n\nfunc VerifyCtx(pub *PublicKey, message []byte, sig []byte, context string) error {\n\tfipsSelfTest()\n\t// FIPS 186-5 specifies Ed25519 and Ed25519ph (with context), but not Ed25519ctx.\n\tfips140.RecordNonApproved()\n\tif l := len(context); l > 255 {\n\t\treturn errors.New(\"ed25519: bad Ed25519ctx context length: \" + strconv.Itoa(l))\n\t}\n\treturn verifyWithDom(pub, message, sig, domPrefixCtx, context)\n}\n\nfunc verifyWithDom(pub *PublicKey, message, sig []byte, domPrefix, context string) error {\n\tif l := len(sig); l != signatureSize {\n\t\treturn errors.New(\"ed25519: bad signature length: \" + strconv.Itoa(l))\n\t}\n\n\tif sig[63]&224 != 0 {\n\t\treturn errors.New(\"ed25519: invalid signature\")\n\t}\n\n\tkh := sha512.New()\n\tif domPrefix != domPrefixPure {\n\t\tkh.Write([]byte(domPrefix))\n\t\tkh.Write([]byte{byte(len(context))})\n\t\tkh.Write([]byte(context))\n\t}\n\tkh.Write(sig[:32])\n\tkh.Write(pub.aBytes[:])\n\tkh.Write(message)\n\thramDigest := make([]byte, 0, sha512Size)\n\thramDigest = kh.Sum(hramDigest)\n\tk, err := edwards25519.NewScalar().SetUniformBytes(hramDigest)\n\tif err != nil {\n\t\tpanic(\"ed25519: internal error: setting scalar failed\")\n\t}\n","sourceCodeStart":278,"sourceCodeEnd":314,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/fips140/ed25519/ed25519.go#L278-L314","documentation":"Returned by verifyWithDom when sig[63] & 224 != 0 — i.e. the high three bits of the 32-byte S scalar are non-zero. Ed25519 mandates S be canonical (less than the group order L, ~2^252), so the high bits must be zero. A signature failing this check is malformed or crafted to exploit non-canonical scalars.","triggerScenarios":"Calling an Ed25519 Verify variant with a 64-byte signature whose trailing 32 bytes encode an S value >= L (high bits set).","commonSituations":"Corrupted signature bytes; signature from a buggy signer that did not reduce S mod L; adversarial input probing for verification malleability; byte-swap or endianness mistake.","solutions":["Reject the signature as malformed — do not attempt to 'normalize' it.","Audit the signer if many signatures fail this check; it likely is not producing canonical S.","Verify against a reference implementation (e.g. the standard ed25519 package) to confirm the bytes are genuinely malformed."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Cheap pre-check: high 3 bits of S must be zero (S < 2^252 is enforced more strictly next).\nif len(sig) == 64 && sig[63]&224 != 0 {\n    return ErrMalformedSignature\n}\nreturn ed25519.Verify(pub, message, sig)","typeGuard":null,"tryCatchPattern":"if err := ed25519.Verify(pub, message, sig); err != nil {\n    if strings.Contains(err.Error(), \"invalid signature\") {\n        // covers high-bits-set, non-canonical S, and equation failure\n        return ErrSignatureRejected\n    }\n    return err\n}","preventionTips":["Reject high-bit-set signatures early as malformed.","Audit signers that produce non-canonical S.","Never attempt to normalize a malformed signature."],"tags":["crypto","ed25519","fips140","signature","canonicalization"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}