Consider signatures with invalid or small-order elements invalid

[twiss]

When verifying an Ed25519 or Ed448 signature, if the public key or the first half of the signature (R) is an invalid or small-order element, return false.

Resolves #10; replaces #13 and #17.

---

Preview | Diff

[panva]

I don't believe these are necessary as the boolean outcome would IIUC always be false for these elements.

This was originally proposed as a way to short curcuit the operation but implementation shows us that it is anything but fast for implementations that don't have an identity check in their underlying crypto.

[twiss]

I don't believe these are necessary as the boolean outcome would IIUC always be false for these elements.

I don't think that's required by RFC8032. In fact, the main problem with small-order points is that more things might verify than you'd expect (e.g. a single signature might verify multiple messages - see https://eprint.iacr.org/2020/823.pdf).

But, it's true that if you have an implementation that does the check and then returns false (or the equivalent of a normal signature verification failure), it's a bit annoying to have to return an error instead. So, I'll change it to returning false.