Implement ed448-shake256

14 files changed, 684 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index 93a91d5a..aa208c29 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -18,6 +18,23 @@
 	* eddsa-pubkey.c (_eddsa_public_key_itch): Assert that
 	_eddsa_compress_itch isn't too large.
 
+	Implementation of ed448-shake256, based on patch by Daiki Ueno.
+	* ed448-shake256-pubkey.c (ed448_shake256_public_key): New file
+	and function.
+	* ed448-shake256-sign.c (ed448_shake256_sign): New file and function.
+	* ed448-shake256-verify.c (ed448_shake256_verify): New file and function.
+
+	* Makefile.in (hogweed_SOURCES): Add new ed448 files.
+
+	* testsuite/eddsa-verify-test.c (test_ed448): New function.
+	(test_main): New ed448 tests.
+	* testsuite/eddsa-sign-test.c (test_ed448_sign): New function.
+	(test_main): New ed448 tests.
+	* testsuite/ed448-test.c: New tests.
+	* testsuite/Makefile.in (TS_HOGWEED_SOURCES): Add ed448-test.c.
+
+	* nettle.texinfo (Curve 25519 and Curve 448): Document ed448.
+
 2020-01-01  Niels Möller  <nisse@lysator.liu.se>
 
 	* ecc-448.c (ecc_mod_pow_2kp1): New function.
diff --git a/Makefile.in b/Makefile.in
index 162b50b1..e0c9f5f7 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -192,7 +192,9 @@ hogweed_SOURCES = sexp.c sexp-format.c \
 		  eddsa-compress.c eddsa-decompress.c eddsa-expand.c \
 		  eddsa-hash.c eddsa-pubkey.c eddsa-sign.c eddsa-verify.c \
 		  ed25519-sha512.c ed25519-sha512-pubkey.c \
-		  ed25519-sha512-sign.c ed25519-sha512-verify.c
+		  ed25519-sha512-sign.c ed25519-sha512-verify.c \
+		  ed448-shake256.c ed448-shake256-pubkey.c \
+		  ed448-shake256-sign.c ed448-shake256-verify.c
 
 OPT_SOURCES = fat-x86_64.c fat-arm.c mini-gmp.c
 
diff --git a/ed448-shake256-pubkey.c b/ed448-shake256-pubkey.c
new file mode 100644
index 00000000..bde18278
--- /dev/null
+++ b/ed448-shake256-pubkey.c
@@ -0,0 +1,61 @@
+/* ed448-shake256-pubkey.c
+
+   Copyright (C) 2017 Daiki Ueno
+   Copyright (C) 2017 Red Hat, Inc.
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "eddsa.h"
+
+#include "ecc-internal.h"
+#include "eddsa-internal.h"
+#include "sha3.h"
+
+void
+ed448_shake256_public_key (uint8_t *pub, const uint8_t *priv)
+{
+  const struct ecc_curve *ecc = &_nettle_curve448;
+  struct sha3_256_ctx ctx;
+  uint8_t digest[ED448_SIGNATURE_SIZE];
+  mp_size_t itch = ecc->q.size + _eddsa_public_key_itch (ecc);
+  mp_limb_t *scratch = gmp_alloc_limbs (itch);
+
+#define k scratch
+#define scratch_out (scratch + ecc->q.size)
+  sha3_256_init (&ctx);
+  _eddsa_expand_key (ecc, &_nettle_ed448_shake256, &ctx, priv, digest, k);
+  _eddsa_public_key (ecc, k, pub, scratch_out);
+
+  gmp_free_limbs (scratch, itch);
+#undef k
+#undef scratch_out
+}
diff --git a/ed448-shake256-sign.c b/ed448-shake256-sign.c
new file mode 100644
index 00000000..c524593d
--- /dev/null
+++ b/ed448-shake256-sign.c
@@ -0,0 +1,69 @@
+/* ed448-shake256-sign.c
+
+   Copyright (C) 2017 Daiki Ueno
+   Copyright (C) 2017 Red Hat, Inc.
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "eddsa.h"
+
+#include "ecc-internal.h"
+#include "eddsa-internal.h"
+#include "sha3.h"
+
+void
+ed448_shake256_sign (const uint8_t *pub,
+		     const uint8_t *priv,
+		     size_t length, const uint8_t *msg,
+		     uint8_t *signature)
+{
+  const struct ecc_curve *ecc = &_nettle_curve448;
+  const struct ecc_eddsa *eddsa = &_nettle_ed448_shake256;
+  mp_size_t itch = ecc->q.size + _eddsa_sign_itch (ecc);
+  mp_limb_t *scratch = gmp_alloc_limbs (itch);
+#define k2 scratch
+#define scratch_out (scratch + ecc->q.size)
+  struct sha3_256_ctx ctx;
+  uint8_t digest[ED448_SIGNATURE_SIZE];
+
+  sha3_256_init (&ctx);
+  _eddsa_expand_key (ecc, eddsa, &ctx, priv, digest, k2);
+
+  _eddsa_sign (ecc, eddsa, &ctx,
+	       pub, digest + ED448_KEY_SIZE, k2,
+	       length, msg, signature, scratch_out);
+
+  gmp_free_limbs (scratch, itch);
+#undef k1
+#undef k2
+#undef scratch_out
+}
diff --git a/ed448-shake256-verify.c b/ed448-shake256-verify.c
new file mode 100644
index 00000000..af16f107
--- /dev/null
+++ b/ed448-shake256-verify.c
@@ -0,0 +1,69 @@
+/* ed448-shake256-verify.c
+
+   Copyright (C) 2017 Daiki Ueno
+   Copyright (C) 2017 Red Hat, Inc.
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <string.h>
+
+#include "eddsa.h"
+
+#include "ecc-internal.h"
+#include "eddsa-internal.h"
+#include "sha3.h"
+
+int
+ed448_shake256_verify (const uint8_t *pub,
+		       size_t length, const uint8_t *msg,
+		       const uint8_t *signature)
+{
+  const struct ecc_curve *ecc = &_nettle_curve448;
+  mp_size_t itch = 3*ecc->p.size + _eddsa_verify_itch (ecc);
+  mp_limb_t *scratch = gmp_alloc_limbs (itch);
+  struct sha3_256_ctx ctx;
+  int res;
+#define A scratch
+#define scratch_out (scratch + 3*ecc->p.size)
+  sha3_256_init (&ctx);
+
+  res = (_eddsa_decompress (ecc,
+			    A, pub, scratch_out)
+	 && _eddsa_verify (ecc, &_nettle_ed448_shake256, pub, A,
+			   &ctx,
+			   length, msg, signature,
+			   scratch_out));
+  gmp_free_limbs (scratch, itch);
+  return res;
+#undef A
+#undef scratch_out
+}
diff --git a/ed448-shake256.c b/ed448-shake256.c
new file mode 100644
index 00000000..4e54b2c6
--- /dev/null
+++ b/ed448-shake256.c
@@ -0,0 +1,52 @@
+/* ed448-shake256.c
+
+   Copyright (C) 2019 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "eddsa-internal.h"
+
+#include "nettle-types.h"
+#include "sha3.h"
+
+#define DOM_SIZE 10
+static const uint8_t ed448_dom[DOM_SIZE] =
+  { 'S', 'i', 'g', 'E', 'd', '4', '4', '8', 0, 0};
+
+const struct ecc_eddsa _nettle_ed448_shake256 =
+  {
+    (nettle_hash_update_func *) sha3_256_update,
+    (nettle_hash_digest_func *) sha3_256_shake,
+    ed448_dom, DOM_SIZE,
+    ~(mp_limb_t) 3,
+    (mp_limb_t) 1 << (447 % GMP_NUMB_BITS),
+  };
diff --git a/eddsa-internal.h b/eddsa-internal.h
index ea4c5e34..f7730a38 100644
--- a/eddsa-internal.h
+++ b/eddsa-internal.h
@@ -66,6 +66,7 @@ struct ecc_eddsa
 };
 
 extern const struct ecc_eddsa _nettle_ed25519_sha512;
+extern const struct ecc_eddsa _nettle_ed448_shake256;
 
 mp_size_t
 _eddsa_compress_itch (const struct ecc_curve *ecc);
diff --git a/eddsa.h b/eddsa.h
index 968ffffb..c85d8321 100644
--- a/eddsa.h
+++ b/eddsa.h
@@ -45,6 +45,9 @@ extern "C" {
 #define ed25519_sha512_public_key nettle_ed25519_sha512_public_key
 #define ed25519_sha512_sign nettle_ed25519_sha512_sign
 #define ed25519_sha512_verify nettle_ed25519_sha512_verify
+#define ed448_shake256_public_key nettle_ed448_shake256_public_key
+#define ed448_shake256_sign nettle_ed448_shake256_sign
+#define ed448_shake256_verify nettle_ed448_shake256_verify
 
 #define ED25519_KEY_SIZE 32
 #define ED25519_SIGNATURE_SIZE 64
@@ -63,6 +66,22 @@ ed25519_sha512_verify (const uint8_t *pub,
 		       size_t length, const uint8_t *msg,
 		       const uint8_t *signature);
 
+#define ED448_KEY_SIZE 57
+#define ED448_SIGNATURE_SIZE 114
+
+void
+ed448_shake256_public_key (uint8_t *pub, const uint8_t *priv);
+
+void
+ed448_shake256_sign (const uint8_t *pub,
+		     const uint8_t *priv,
+		     size_t length, const uint8_t *msg,
+		     uint8_t *signature);
+
+int
+ed448_shake256_verify (const uint8_t *pub,
+		       size_t length, const uint8_t *msg,
+		       const uint8_t *signature);
 			   
 #ifdef __cplusplus
 }
diff --git a/nettle.texinfo b/nettle.texinfo
index 2df85e77..65b36e31 100644
--- a/nettle.texinfo
+++ b/nettle.texinfo
@@ -5213,6 +5213,31 @@ Verifies a message using the provided public key. Returns 1 if the
 signature is valid, otherwise 0.
 @end deftypefun
 
+Nettle also provides Ed448, an EdDSA signature scheme based on an
+Edwards curve equivalent to curve448.
+
+@defvr Constant ED448_KEY_SIZE
+The size of a private or public Ed448 key, 57 octets.
+@end defvr
+
+@defvr Constant ED448_SIGNATURE_SIZE
+The size of an Ed448 signature, 114 octets.
+@end defvr
+
+@deftypefun void ed448_shake256_public_key (uint8_t *@var{pub}, const uint8_t *@var{priv})
+Computes the public key corresponding to the given private key. Both
+input and output are of size @code{ED448_KEY_SIZE}.
+@end deftypefun
+
+@deftypefun void ed448_shake256_sign (const uint8_t *@var{pub}, const uint8_t *@var{priv}, size_t @var{length}, const uint8_t *@var{msg}, uint8_t *@var{signature})
+Signs a message using the provided key pair.
+@end deftypefun
+
+@deftypefun int ed448_shake256_verify (const uint8_t *@var{pub}, size_t @var{length}, const uint8_t *@var{msg}, const uint8_t *@var{signature})
+Verifies a message using the provided public key. Returns 1 if the
+signature is valid, otherwise 0.
+@end deftypefun
+
 @node Randomness, ASCII encoding, Public-key algorithms, Reference
 @comment  node-name,  next,  previous,  up
 @section Randomness
diff --git a/testsuite/.test-rules.make b/testsuite/.test-rules.make
index c9344e5e..6dbef7e2 100644
--- a/testsuite/.test-rules.make
+++ b/testsuite/.test-rules.make
@@ -286,6 +286,9 @@ eddsa-verify-test$(EXEEXT): eddsa-verify-test.$(OBJEXT)
 ed25519-test$(EXEEXT): ed25519-test.$(OBJEXT)
 	$(LINK) ed25519-test.$(OBJEXT) $(TEST_OBJS) -o ed25519-test$(EXEEXT)
 
+ed448-test$(EXEEXT): ed448-test.$(OBJEXT)
+	$(LINK) ed448-test.$(OBJEXT) $(TEST_OBJS) -o ed448-test$(EXEEXT)
+
 sha1-huge-test$(EXEEXT): sha1-huge-test.$(OBJEXT)
 	$(LINK) sha1-huge-test.$(OBJEXT) $(TEST_OBJS) -o sha1-huge-test$(EXEEXT)
 
diff --git a/testsuite/Makefile.in b/testsuite/Makefile.in
index f49c803b..97128040 100644
--- a/testsuite/Makefile.in
+++ b/testsuite/Makefile.in
@@ -53,7 +53,7 @@ TS_HOGWEED_SOURCES = sexp-test.c sexp-format-test.c \
 		     ecdsa-sign-test.c ecdsa-verify-test.c \
 		     ecdsa-keygen-test.c ecdh-test.c \
 		     eddsa-compress-test.c eddsa-sign-test.c \
-		     eddsa-verify-test.c ed25519-test.c
+		     eddsa-verify-test.c ed25519-test.c ed448-test.c
 
 TS_SOURCES = $(TS_NETTLE_SOURCES) $(TS_HOGWEED_SOURCES)
 CXX_SOURCES = cxx-test.cxx
diff --git a/testsuite/ed448-test.c b/testsuite/ed448-test.c
new file mode 100644
index 00000000..56dc6277
--- /dev/null
+++ b/testsuite/ed448-test.c
@@ -0,0 +1,240 @@
+/* ed448-test.c
+
+   Copyright (C) 2017 Daiki Ueno
+   Copyright (C) 2017 Red Hat, Inc.
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#include "testutils.h"
+
+#include <errno.h>
+
+#include "eddsa.h"
+
+#include "base16.h"
+
+static void
+decode_hex (size_t length, uint8_t *dst, const char *src)
+{
+  struct base16_decode_ctx ctx;
+  size_t out_size;
+  base16_decode_init (&ctx);
+  ASSERT (base16_decode_update (&ctx, &out_size, dst, 2*length, src));
+  ASSERT (out_size == length);
+  ASSERT (base16_decode_final (&ctx));
+}
+
+/* Processes a single line in the format of
+   http://ed25519.cr.yp.to/python/sign.input:
+
+     sk pk : pk : m : s m :
+
+   where sk (secret key) and pk (public key) are 57 bytes each, m is
+   variable size, and s is 114 bytes. All values hex encoded.
+*/
+static void
+test_one (const char *line)
+{
+  const char *p;
+  const char *mp;
+  uint8_t sk[ED448_KEY_SIZE];
+  uint8_t pk[ED448_KEY_SIZE];
+  uint8_t t[ED448_KEY_SIZE];
+  uint8_t s[ED448_SIGNATURE_SIZE];
+  uint8_t *msg;
+  size_t msg_size;
+  uint8_t s2[ED448_SIGNATURE_SIZE];
+
+  decode_hex (ED448_KEY_SIZE, sk, line);
+
+  p = strchr (line, ':');
+  ASSERT (p == line + 228);
+  p++;
+  decode_hex (ED448_KEY_SIZE, pk, p);
+  p = strchr (p, ':');
+  ASSERT (p == line + 343);
+  mp = ++p;
+  p = strchr (p, ':');
+  ASSERT (p);
+  ASSERT ((p - mp) % 2 == 0);
+  msg_size = (p - mp) / 2;
+
+  decode_hex (ED448_SIGNATURE_SIZE, s, p+1);
+
+  msg = xalloc (msg_size + 1);
+  msg[msg_size] = 'x';
+
+  decode_hex (msg_size, msg, mp);
+
+  ed448_shake256_public_key (t, sk);
+  ASSERT (MEMEQ(ED448_KEY_SIZE, t, pk));
+
+  ed448_shake256_sign (pk, sk, msg_size, msg, s2);
+  ASSERT (MEMEQ (ED448_SIGNATURE_SIZE, s, s2));
+
+  ASSERT (ed448_shake256_verify (pk, msg_size, msg, s));
+
+  s2[ED448_SIGNATURE_SIZE/3] ^= 0x40;
+  ASSERT (!ed448_shake256_verify (pk, msg_size, msg, s2));
+
+  memcpy (s2, s, ED448_SIGNATURE_SIZE);
+  s2[2*ED448_SIGNATURE_SIZE/3] ^= 0x40;
+  ASSERT (!ed448_shake256_verify (pk, msg_size, msg, s2));
+
+  ASSERT (!ed448_shake256_verify (pk, msg_size + 1, msg, s));
+
+  if (msg_size > 0)
+    {
+      msg[msg_size-1] ^= 0x20;
+      ASSERT (!ed448_shake256_verify (pk, msg_size, msg, s));
+    }
+  free (msg);
+}
+
+#ifndef HAVE_GETLINE
+static ssize_t
+getline(char **lineptr, size_t *n, FILE *f)
+{
+  size_t i;
+  int c;
+  if (!*lineptr)
+    {
+      *n = 500;
+      *lineptr = xalloc (*n);
+    }
+
+  i = 0;
+  do
+    {
+      c = getc(f);
+      if (c < 0)
+	{
+	  if (i > 0)
+	    break;
+	  return -1;
+	}
+
+      (*lineptr) [i++] = c;
+      if (i == *n)
+	{
+	  *n *= 2;
+	  *lineptr = realloc (*lineptr, *n);
+	  if (!*lineptr)
+	    die ("Virtual memory exhausted.\n");
+	}
+    } while (c != '\n');
+
+  (*lineptr) [i] = 0;
+  return i;
+}
+#endif
+
+void
+test_main(void)
+{
+  const char *input = getenv ("ED448_SIGN_INPUT");
+  if (input)
+    {
+      size_t buf_size;
+      char *buf;
+      FILE *f = fopen (input, "r");
+      if (!f)
+	die ("Opening input file '%s' failed: %s\n",
+	     input, strerror (errno));
+
+      for (buf = NULL; getline (&buf, &buf_size, f) >= 0; )
+	test_one (buf);
+
+      free (buf);
+      fclose (f);
+    }
+  else
+    {
+      /* Test vectors from RFC 8032.  */
+      /* Blank */
+      test_one ("6c82a562cb808d10d632be89c8513ebf6c929f34ddfa8c9f63c9960ef6e348a3528c8a3fcc2f044e39a3fc5b94492f8f032e7549a20098f95b"
+		"5fd7449b59b461fd2ce787ec616ad46a1da1342485a70e1f8a0ea75d80e96778edf124769b46c7061bd6783df1e50f6cd1fa1abeafe8256180:"
+		"5fd7449b59b461fd2ce787ec616ad46a1da1342485a70e1f8a0ea75d80e96778edf124769b46c7061bd6783df1e50f6cd1fa1abeafe8256180:"
+		":"
+		"533a37f6bbe457251f023c0d88f976ae2dfb504a843e34d2074fd823d41a591f2b233f034f628281f2fd7a22ddd47d7828c59bd0a21bfd3980ff0d2028d4b18a9df63e006c5d1c2d345b925d8dc00b4104852db99ac5c7cdda8530a113a0f4dbb61149f05a7363268c71d95808ff2e652600"
+		":");
+      /* 1 octet */
+      test_one ("c4eab05d357007c632f3dbb48489924d552b08fe0c353a0d4a1f00acda2c463afbea67c5e8d2877c5e3bc397a659949ef8021e954e0a12274e"
+		"43ba28f430cdff456ae531545f7ecd0ac834a55d9358c0372bfa0c6c6798c0866aea01eb00742802b8438ea4cb82169c235160627b4c3a9480:"
+		"43ba28f430cdff456ae531545f7ecd0ac834a55d9358c0372bfa0c6c6798c0866aea01eb00742802b8438ea4cb82169c235160627b4c3a9480:"
+		"03:"
+		"26b8f91727bd62897af15e41eb43c377efb9c610d48f2335cb0bd0087810f4352541b143c4b981b7e18f62de8ccdf633fc1bf037ab7cd779805e0dbcc0aae1cbcee1afb2e027df36bc04dcecbf154336c19f0af7e0a6472905e799f1953d2a0ff3348ab21aa4adafd1d234441cf807c03a00"
+		"03:");
+      /* 11 octets */
+      test_one ("cd23d24f714274e744343237b93290f511f6425f98e64459ff203e8985083ffdf60500553abc0e05cd02184bdb89c4ccd67e187951267eb328"
+		"dcea9e78f35a1bf3499a831b10b86c90aac01cd84b67a0109b55a36e9328b1e365fce161d71ce7131a543ea4cb5f7e9f1d8b00696447001400:"
+		"dcea9e78f35a1bf3499a831b10b86c90aac01cd84b67a0109b55a36e9328b1e365fce161d71ce7131a543ea4cb5f7e9f1d8b00696447001400:"
+		"0c3e544074ec63b0265e0c:"
+		"1f0a8888ce25e8d458a21130879b840a9089d999aaba039eaf3e3afa090a09d389dba82c4ff2ae8ac5cdfb7c55e94d5d961a29fe0109941e00b8dbdeea6d3b051068df7254c0cdc129cbe62db2dc957dbb47b51fd3f213fb8698f064774250a5028961c9bf8ffd973fe5d5c206492b140e00"
+		"0c3e544074ec63b0265e0c:");
+      /* 12 octets */
+      test_one ("258cdd4ada32ed9c9ff54e63756ae582fb8fab2ac721f2c8e676a72768513d939f63dddb55609133f29adf86ec9929dccb52c1c5fd2ff7e21b"
+		"3ba16da0c6f2cc1f30187740756f5e798d6bc5fc015d7c63cc9510ee3fd44adc24d8e968b6e46e6f94d19b945361726bd75e149ef09817f580:"
+		"3ba16da0c6f2cc1f30187740756f5e798d6bc5fc015d7c63cc9510ee3fd44adc24d8e968b6e46e6f94d19b945361726bd75e149ef09817f580:"
+		"64a65f3cdedcdd66811e2915:"
+		"7eeeab7c4e50fb799b418ee5e3197ff6bf15d43a14c34389b59dd1a7b1b85b4ae90438aca634bea45e3a2695f1270f07fdcdf7c62b8efeaf00b45c2c96ba457eb1a8bf075a3db28e5c24f6b923ed4ad747c3c9e03c7079efb87cb110d3a99861e72003cbae6d6b8b827e4e6c143064ff3c00"
+		"64a65f3cdedcdd66811e2915:");
+      /* 13 octets */
+      test_one ("7ef4e84544236752fbb56b8f31a23a10e42814f5f55ca037cdcc11c64c9a3b2949c1bb60700314611732a6c2fea98eebc0266a11a93970100e"
+		"b3da079b0aa493a5772029f0467baebee5a8112d9d3a22532361da294f7bb3815c5dc59e176b4d9f381ca0938e13c6c07b174be65dfa578e80:"
+		"b3da079b0aa493a5772029f0467baebee5a8112d9d3a22532361da294f7bb3815c5dc59e176b4d9f381ca0938e13c6c07b174be65dfa578e80:"
+		"64a65f3cdedcdd66811e2915e7:"
+		"6a12066f55331b6c22acd5d5bfc5d71228fbda80ae8dec26bdd306743c5027cb4890810c162c027468675ecf645a83176c0d7323a2ccde2d80efe5a1268e8aca1d6fbc194d3f77c44986eb4ab4177919ad8bec33eb47bbb5fc6e28196fd1caf56b4e7e0ba5519234d047155ac727a1053100"
+		"64a65f3cdedcdd66811e2915e7:");
+      /* 64 octets */
+      test_one ("d65df341ad13e008567688baedda8e9dcdc17dc024974ea5b4227b6530e339bff21f99e68ca6968f3cca6dfe0fb9f4fab4fa135d5542ea3f01"
+		"df9705f58edbab802c7f8363cfe5560ab1c6132c20a9f1dd163483a26f8ac53a39d6808bf4a1dfbd261b099bb03b3fb50906cb28bd8a081f00:"
+		"df9705f58edbab802c7f8363cfe5560ab1c6132c20a9f1dd163483a26f8ac53a39d6808bf4a1dfbd261b099bb03b3fb50906cb28bd8a081f00:"
+		"bd0f6a3747cd561bdddf4640a332461a4a30a12a434cd0bf40d766d9c6d458e5512204a30c17d1f50b5079631f64eb3112182da3005835461113718d1a5ef944:"
+		"554bc2480860b49eab8532d2a533b7d578ef473eeb58c98bb2d0e1ce488a98b18dfde9b9b90775e67f47d4a1c3482058efc9f40d2ca033a0801b63d45b3b722ef552bad3b4ccb667da350192b61c508cf7b6b5adadc2c8d9a446ef003fb05cba5f30e88e36ec2703b349ca229c2670833900"
+		"bd0f6a3747cd561bdddf4640a332461a4a30a12a434cd0bf40d766d9c6d458e5512204a30c17d1f50b5079631f64eb3112182da3005835461113718d1a5ef944:");
+      /* 256 octets */
+      test_one ("2ec5fe3c17045abdb136a5e6a913e32ab75ae68b53d2fc149b77e504132d37569b7e766ba74a19bd6162343a21c8590aa9cebca9014c636df5"
+		"79756f014dcfe2079f5dd9e718be4171e2ef2486a08f25186f6bff43a9936b9bfe12402b08ae65798a3d81e22e9ec80e7690862ef3d4ed3a00:"
+		"79756f014dcfe2079f5dd9e718be4171e2ef2486a08f25186f6bff43a9936b9bfe12402b08ae65798a3d81e22e9ec80e7690862ef3d4ed3a00:"
+		"15777532b0bdd0d1389f636c5f6b9ba734c90af572877e2d272dd078aa1e567cfa80e12928bb542330e8409f3174504107ecd5efac61ae7504dabe2a602ede89e5cca6257a7c77e27a702b3ae39fc769fc54f2395ae6a1178cab4738e543072fc1c177fe71e92e25bf03e4ecb72f47b64d0465aaea4c7fad372536c8ba516a6039c3c2a39f0e4d832be432dfa9a706a6e5c7e19f397964ca4258002f7c0541b590316dbc5622b6b2a6fe7a4abffd96105eca76ea7b98816af0748c10df048ce012d901015a51f189f3888145c03650aa23ce894c3bd889e030d565071c59f409a9981b51878fd6fc110624dcbcde0bf7a69ccce38fabdf86f3bef6044819de11:"
+		"c650ddbb0601c19ca11439e1640dd931f43c518ea5bea70d3dcde5f4191fe53f00cf966546b72bcc7d58be2b9badef28743954e3a44a23f880e8d4f1cfce2d7a61452d26da05896f0a50da66a239a8a188b6d825b3305ad77b73fbac0836ecc60987fd08527c1a8e80d5823e65cafe2a3d00"
+		"15777532b0bdd0d1389f636c5f6b9ba734c90af572877e2d272dd078aa1e567cfa80e12928bb542330e8409f3174504107ecd5efac61ae7504dabe2a602ede89e5cca6257a7c77e27a702b3ae39fc769fc54f2395ae6a1178cab4738e543072fc1c177fe71e92e25bf03e4ecb72f47b64d0465aaea4c7fad372536c8ba516a6039c3c2a39f0e4d832be432dfa9a706a6e5c7e19f397964ca4258002f7c0541b590316dbc5622b6b2a6fe7a4abffd96105eca76ea7b98816af0748c10df048ce012d901015a51f189f3888145c03650aa23ce894c3bd889e030d565071c59f409a9981b51878fd6fc110624dcbcde0bf7a69ccce38fabdf86f3bef6044819de11:");
+      /* 1023 octets */
+      test_one ("872d093780f5d3730df7c212664b37b8a0f24f56810daa8382cd4fa3f77634ec44dc54f1c2ed9bea86fafb7632d8be199ea165f5ad55dd9ce8"
+		"a81b2e8a70a5ac94ffdbcc9badfc3feb0801f258578bb114ad44ece1ec0e799da08effb81c5d685c0c56f64eecaef8cdf11cc38737838cf400:"
+		"a81b2e8a70a5ac94ffdbcc9badfc3feb0801f258578bb114ad44ece1ec0e799da08effb81c5d685c0c56f64eecaef8cdf11cc38737838cf400:"
+		"6ddf802e1aae4986935f7f981ba3f0351d6273c0a0c22c9c0e8339168e675412a3debfaf435ed651558007db4384b650fcc07e3b586a27a4f7a00ac8a6fec2cd86ae4bf1570c41e6a40c931db27b2faa15a8cedd52cff7362c4e6e23daec0fbc3a79b6806e316efcc7b68119bf46bc76a26067a53f296dafdbdc11c77f7777e972660cf4b6a9b369a6665f02e0cc9b6edfad136b4fabe723d2813db3136cfde9b6d044322fee2947952e031b73ab5c603349b307bdc27bc6cb8b8bbd7bd323219b8033a581b59eadebb09b3c4f3d2277d4f0343624acc817804728b25ab797172b4c5c21a22f9c7839d64300232eb66e53f31c723fa37fe387c7d3e50bdf9813a30e5bb12cf4cd930c40cfb4e1fc622592a49588794494d56d24ea4b40c89fc0596cc9ebb961c8cb10adde976a5d602b1c3f85b9b9a001ed3c6a4d3b1437f52096cd1956d042a597d561a596ecd3d1735a8d570ea0ec27225a2c4aaff263"
+		"06d1526c1af3ca6d9cf5a2c98f47e1c46db9a33234cfd4d81f2c98538a09ebe76998d0d8fd25997c7d255c6d66ece6fa56f11144950f027795e653008f4bd7ca2dee85d8e90f3dc315130ce2a00375a318c7c3d97be2c8ce5b6db41a6254ff264fa6155baee3b0773c0f497c573f19bb4f4240281f0b1f4f7be857a4e59d416c06b4c50fa09e1810ddc6b1467baeac5a3668d11b6ecaa901440016f389f80acc4db977025e7f5924388c7e340a732e554440e76570f8dd71b7d640b3450d1fd5f0410a18f9a3494f707c717b79b4bf75c98400b096b21653b5d217cf3565c9597456f70703497a078763829bc01bb1cbc8fa04eadc9a6e3f6699587a9e75c94e5bab0036e0b2e711392cff0047d0d6b05bd2a588bc109718954259f1d86678a579a3120f19cfb2963f177aeb70f2d4844826262e51b80271272068ef5b3856fa8535aa2a88b2d41f2a0e2fda7624c2850272ac4a2f561f8f2f7a318bfd5c"
+		"af9696149e4ac824ad3460538fdc25421beec2cc6818162d06bbed0c40a387192349db67a118bada6cd5ab0140ee273204f628aad1c135f770279a651e24d8c14d75a6059d76b96a6fd857def5e0b354b27ab937a5815d16b5fae407ff18222c6d1ed263be68c95f32d908bd895cd76207ae726487567f9a67dad79abec316f683b17f2d02bf07e0ac8b5bc6162cf94697b3c27cd1fea49b27f23ba2901871962506520c392da8b6ad0d99f7013fbc06c2c17a569500c8a7696481c1cd33e9b14e40b82e79a5f5db82571ba97bae3ad3e0479515bb0e2b0f3bfcd1fd33034efc6245eddd7ee2086ddae2600d8ca73e214e8c2b0bdb2b047c6a464a562ed77b73d2d841c4b34973551257713b753632efba348169abc90a68f42611a40126d7cb21b58695568186f7e569d2ff0f9e745d0487dd2eb997cafc5abf9dd102e62ff66cba87:"
+		"e301345a41a39a4d72fff8df69c98075a0cc082b802fc9b2b6bc503f926b65bddf7f4c8f1cb49f6396afc8a70abe6d8aef0db478d4c6b2970076c6a0484fe76d76b3a97625d79f1ce240e7c576750d295528286f719b413de9ada3e8eb78ed573603ce30d8bb761785dc30dbc320869e1a00"
+		"6ddf802e1aae4986935f7f981ba3f0351d6273c0a0c22c9c0e8339168e675412a3debfaf435ed651558007db4384b650fcc07e3b586a27a4f7a00ac8a6fec2cd86ae4bf1570c41e6a40c931db27b2faa15a8cedd52cff7362c4e6e23daec0fbc3a79b6806e316efcc7b68119bf46bc76a26067a53f296dafdbdc11c77f7777e972660cf4b6a9b369a6665f02e0cc9b6edfad136b4fabe723d2813db3136cfde9b6d044322fee2947952e031b73ab5c603349b307bdc27bc6cb8b8bbd7bd323219b8033a581b59eadebb09b3c4f3d2277d4f0343624acc817804728b25ab797172b4c5c21a22f9c7839d64300232eb66e53f31c723fa37fe387c7d3e50bdf9813a30e5bb12cf4cd930c40cfb4e1fc622592a49588794494d56d24ea4b40c89fc0596cc9ebb961c8cb10adde976a5d602b1c3f85b9b9a001ed3c6a4d3b1437f52096cd1956d042a597d561a596ecd3d1735a8d570ea0ec27225a2c4aaff263"
+		"06d1526c1af3ca6d9cf5a2c98f47e1c46db9a33234cfd4d81f2c98538a09ebe76998d0d8fd25997c7d255c6d66ece6fa56f11144950f027795e653008f4bd7ca2dee85d8e90f3dc315130ce2a00375a318c7c3d97be2c8ce5b6db41a6254ff264fa6155baee3b0773c0f497c573f19bb4f4240281f0b1f4f7be857a4e59d416c06b4c50fa09e1810ddc6b1467baeac5a3668d11b6ecaa901440016f389f80acc4db977025e7f5924388c7e340a732e554440e76570f8dd71b7d640b3450d1fd5f0410a18f9a3494f707c717b79b4bf75c98400b096b21653b5d217cf3565c9597456f70703497a078763829bc01bb1cbc8fa04eadc9a6e3f6699587a9e75c94e5bab0036e0b2e711392cff0047d0d6b05bd2a588bc109718954259f1d86678a579a3120f19cfb2963f177aeb70f2d4844826262e51b80271272068ef5b3856fa8535aa2a88b2d41f2a0e2fda7624c2850272ac4a2f561f8f2f7a318bfd5c"
+		"af9696149e4ac824ad3460538fdc25421beec2cc6818162d06bbed0c40a387192349db67a118bada6cd5ab0140ee273204f628aad1c135f770279a651e24d8c14d75a6059d76b96a6fd857def5e0b354b27ab937a5815d16b5fae407ff18222c6d1ed263be68c95f32d908bd895cd76207ae726487567f9a67dad79abec316f683b17f2d02bf07e0ac8b5bc6162cf94697b3c27cd1fea49b27f23ba2901871962506520c392da8b6ad0d99f7013fbc06c2c17a569500c8a7696481c1cd33e9b14e40b82e79a5f5db82571ba97bae3ad3e0479515bb0e2b0f3bfcd1fd33034efc6245eddd7ee2086ddae2600d8ca73e214e8c2b0bdb2b047c6a464a562ed77b73d2d841c4b34973551257713b753632efba348169abc90a68f42611a40126d7cb21b58695568186f7e569d2ff0f9e745d0487dd2eb997cafc5abf9dd102e62ff66cba87:");
+    }
+}
diff --git a/testsuite/eddsa-sign-test.c b/testsuite/eddsa-sign-test.c
index 47ca6e76..2ea1e4bd 100644
--- a/testsuite/eddsa-sign-test.c
+++ b/testsuite/eddsa-sign-test.c
@@ -33,6 +33,7 @@
 
 #include "eddsa.h"
 #include "eddsa-internal.h"
+#include "sha3.h"
 
 static void
 test_eddsa_sign (const struct ecc_curve *ecc,
@@ -112,6 +113,19 @@ test_ed25519_sign (const struct tstring *public,
 		   public, private, msg, ref);
 }
 
+static void
+test_ed448_sign (const struct tstring *public,
+		 const struct tstring *private,
+		 const struct tstring *msg,
+		 const struct tstring *ref)
+{
+  struct sha3_256_ctx ctx;
+
+  sha3_256_init (&ctx);
+  test_eddsa_sign (&_nettle_curve448, &_nettle_ed448_shake256, &ctx,
+		   public, private, msg, ref);
+}
+
 void
 test_main (void)
 {
@@ -150,4 +164,59 @@ test_main (void)
 			  "99df1340cce54626 183144ef46887163"
 			  "4b0a5c0033534108 e1c67c0dc99d3014"
 			  "f01084e98c95e101 4b309b1dbb2e6704"));
+  /* Based on a few of the test vectors from RFC 8032 */
+  test_ed448_sign (SHEX("5fd7449b59b461fd 2ce787ec616ad46a"
+			"1da1342485a70e1f 8a0ea75d80e96778"
+			"edf124769b46c706 1bd6783df1e50f6c"
+			"d1fa1abeafe82561 80"),
+		   SHEX("6c82a562cb808d10 d632be89c8513ebf"
+			"6c929f34ddfa8c9f 63c9960ef6e348a3"
+			"528c8a3fcc2f044e 39a3fc5b94492f8f"
+			"032e7549a20098f9 5b"),
+		   SHEX(""),
+		   SHEX("533a37f6bbe45725 1f023c0d88f976ae"
+			"2dfb504a843e34d2 074fd823d41a591f"
+			"2b233f034f628281 f2fd7a22ddd47d78"
+			"28c59bd0a21bfd39 80ff0d2028d4b18a"
+			"9df63e006c5d1c2d 345b925d8dc00b41"
+			"04852db99ac5c7cd da8530a113a0f4db"
+			"b61149f05a736326 8c71d95808ff2e65"
+			"2600"));
+  test_ed448_sign (SHEX("43ba28f430cdff45 6ae531545f7ecd0a"
+			"c834a55d9358c037 2bfa0c6c6798c086"
+			"6aea01eb00742802 b8438ea4cb82169c"
+			"235160627b4c3a94 80"),
+		   SHEX("c4eab05d357007c6 32f3dbb48489924d"
+			"552b08fe0c353a0d 4a1f00acda2c463a"
+			"fbea67c5e8d2877c 5e3bc397a659949e"
+			"f8021e954e0a1227 4e"),
+		   SHEX("03"),
+		   SHEX("26b8f91727bd6289 7af15e41eb43c377"
+			"efb9c610d48f2335 cb0bd0087810f435"
+			"2541b143c4b981b7 e18f62de8ccdf633"
+			"fc1bf037ab7cd779 805e0dbcc0aae1cb"
+			"cee1afb2e027df36 bc04dcecbf154336"
+			"c19f0af7e0a64729 05e799f1953d2a0f"
+			"f3348ab21aa4adaf d1d234441cf807c0"
+			"3a00"));
+  test_ed448_sign (SHEX("df9705f58edbab80 2c7f8363cfe5560a"
+			"b1c6132c20a9f1dd 163483a26f8ac53a"
+			"39d6808bf4a1dfbd 261b099bb03b3fb5"
+			"0906cb28bd8a081f 00"),
+		   SHEX("d65df341ad13e008 567688baedda8e9d"
+			"cdc17dc024974ea5 b4227b6530e339bf"
+			"f21f99e68ca6968f 3cca6dfe0fb9f4fa"
+			"b4fa135d5542ea3f 01"),
+		   SHEX("bd0f6a3747cd561b dddf4640a332461a"
+			"4a30a12a434cd0bf 40d766d9c6d458e5"
+			"512204a30c17d1f5 0b5079631f64eb31"
+			"12182da300583546 1113718d1a5ef944"),
+		   SHEX("554bc2480860b49e ab8532d2a533b7d5"
+			"78ef473eeb58c98b b2d0e1ce488a98b1"
+			"8dfde9b9b90775e6 7f47d4a1c3482058"
+			"efc9f40d2ca033a0 801b63d45b3b722e"
+			"f552bad3b4ccb667 da350192b61c508c"
+			"f7b6b5adadc2c8d9 a446ef003fb05cba"
+			"5f30e88e36ec2703 b349ca229c267083"
+			"3900"));
 }
diff --git a/testsuite/eddsa-verify-test.c b/testsuite/eddsa-verify-test.c
index 595fa404..cc853a55 100644
--- a/testsuite/eddsa-verify-test.c
+++ b/testsuite/eddsa-verify-test.c
@@ -33,6 +33,7 @@
 
 #include "eddsa.h"
 #include "eddsa-internal.h"
+#include "sha3.h"
 
 static void
 test_eddsa (const struct ecc_curve *ecc,
@@ -136,6 +137,17 @@ test_ed25519 (const uint8_t *pub,
 	      pub, msg, signature);
 }
 
+static void
+test_ed448 (const uint8_t *pub,
+	    const struct tstring *msg,
+	    const uint8_t *signature)
+{
+  struct sha3_256_ctx ctx;
+
+  sha3_256_init (&ctx);
+  test_eddsa (&_nettle_curve448, &_nettle_ed448_shake256, &ctx,
+	      pub, msg, signature);
+}
 
 void
 test_main (void)
@@ -167,4 +179,47 @@ test_main (void)
 		  "99df1340cce54626 183144ef46887163"
 		  "4b0a5c0033534108 e1c67c0dc99d3014"
 		  "f01084e98c95e101 4b309b1dbb2e6704"));
+  /* Based on a few of the test vectors from RFC 8032 */
+  test_ed448 (H("5fd7449b59b461fd 2ce787ec616ad46a"
+		"1da1342485a70e1f 8a0ea75d80e96778"
+		"edf124769b46c706 1bd6783df1e50f6c"
+		"d1fa1abeafe82561 80"),
+	      SHEX(""),
+	      H("533a37f6bbe45725 1f023c0d88f976ae"
+		"2dfb504a843e34d2 074fd823d41a591f"
+		"2b233f034f628281 f2fd7a22ddd47d78"
+		"28c59bd0a21bfd39 80ff0d2028d4b18a"
+		"9df63e006c5d1c2d 345b925d8dc00b41"
+		"04852db99ac5c7cd da8530a113a0f4db"
+		"b61149f05a736326 8c71d95808ff2e65"
+		"2600"));
+  test_ed448 (H("43ba28f430cdff45 6ae531545f7ecd0a"
+		"c834a55d9358c037 2bfa0c6c6798c086"
+		"6aea01eb00742802 b8438ea4cb82169c"
+		"235160627b4c3a94 80"),
+	      SHEX("03"),
+	      H("26b8f91727bd6289 7af15e41eb43c377"
+		"efb9c610d48f2335 cb0bd0087810f435"
+		"2541b143c4b981b7 e18f62de8ccdf633"
+		"fc1bf037ab7cd779 805e0dbcc0aae1cb"
+		"cee1afb2e027df36 bc04dcecbf154336"
+		"c19f0af7e0a64729 05e799f1953d2a0f"
+		"f3348ab21aa4adaf d1d234441cf807c0"
+		"3a00"));
+  test_ed448 (H("df9705f58edbab80 2c7f8363cfe5560a"
+		"b1c6132c20a9f1dd 163483a26f8ac53a"
+		"39d6808bf4a1dfbd 261b099bb03b3fb5"
+		"0906cb28bd8a081f 00"),
+	      SHEX("bd0f6a3747cd561b dddf4640a332461a"
+		   "4a30a12a434cd0bf 40d766d9c6d458e5"
+		   "512204a30c17d1f5 0b5079631f64eb31"
+		   "12182da300583546 1113718d1a5ef944"),
+	      H("554bc2480860b49e ab8532d2a533b7d5"
+		"78ef473eeb58c98b b2d0e1ce488a98b1"
+		"8dfde9b9b90775e6 7f47d4a1c3482058"
+		"efc9f40d2ca033a0 801b63d45b3b722e"
+		"f552bad3b4ccb667 da350192b61c508c"
+		"f7b6b5adadc2c8d9 a446ef003fb05cba"
+		"5f30e88e36ec2703 b349ca229c267083"
+		"3900"));
 }