[Cfrg] draft-irtf-cfrg-eddsa - more implementation questions

[Jim Schaad <[e-mail]>]

In step #3 of the verify function, I assume that I can reduce k mod p
without any problems.   Can I reduce it mod L or not?  It would be useful to
have the hint in the text since it is all over the Sign algorithm.

I have been using the python program to help debug my quick implementation
of the signature algorithm.  This has worked up to the point of trying to
decode points as the python code does not use the suggested formula in
section 5.1.3 (use this trick) but instead just directly computes a square
root on the base formula.

I am therefore unable to determine where my bug is:  In my code, in the
formula, or in how I read the formula.  It might be worthwhile to actually
implement this algorithm for computing square roots if that is what is
suggested.  

By the way, I finally found were the neutral point was defined.  You still
might want to highlight it as part of the point addition sections.

Looking at the python code, I think I see the trick you are using to deal
with step 1 in the decoding code for removing the x_0 bit but it could be
highlighted that it is being done in the field parsing function rather than
the decoding function.

Jim