Module certificate 

Versioned, domain-separated Ed25519 batch authentication.

The Ed25519 implementation’s fixed-64 request signs these exact bytes, not a host-prehashed replacement. Eight little-endian 64-bit words map directly to its Words512 message; the 16-bit hardware transaction tag is not signed and must never be used as the cryptographic batch identity.

The problem

A one-time key is only useful if a verifier can tell it really belongs to the signer. Signing each of millions of keys with Ed25519 would cost as much as signing the messages directly. DSig instead groups 128 keys into a batch, builds a Merkle tree over them (see BatchTree) and signs only the tree root, once per batch, with Ed25519.

The decision: one fixed 64-byte envelope

What exactly gets signed must be unambiguous, or a signature made for one purpose could be replayed for another. So the signed message is a fixed 64-byte envelope: a domain string, a profile version, the batch size, the never-reused namespace (epoch, batch_id), and the root.

 byte  0        8        12       16        24          32                64
       ┌────────┬────────┬────────┬─────────┬───────────┬─────────────────┐
       │DSIGFP01│profile │ batch  │  epoch  │ batch_id  │   Merkle root   │
       │ ASCII  │ u32 LE │ size LE│ u64 LE  │  u64 LE   │    32 bytes     │
       │        │  = 1   │ = 128  │         │           │                 │
       └────────┴────────┴────────┴─────────┴───────────┴─────────────────┘
 word     0          1             2          3          4    5    6    7

64 bytes is exactly eight 64-bit words, which is the fixed message size of the Ed25519 hardware core’s Words512 request. So the hardware never has to hash or reshuffle the envelope before signing: batch_commitment_words packs it straight into those eight words.

Two views of the same bytes

• Hardware: batch_commitment_words is an RHDL #[kernel] that the certificate unit (crate::cert_unit) and the bridge (crate::ed25519) call.
• Software: BatchCommitment and BatchCertificate are the host-side oracle used by crate::reference and the host tools. A test checks that both views produce the same words for every root bit.

The 16-bit routing tag that travels next to the request in hardware is not part of these bytes. It only says which outstanding request a result belongs to.

Structs

BatchCertificate

Public batch commitment and its Ed25519 signature.

BatchCommitment

Unambiguous 64-byte message authenticated by the background Ed25519 core.

Constants

DOMAIN

Domain occupying certificate bytes 0 through 7.

PROFILE_ID

Version/profile identifier for the corrected base-four construction.

Functions

batch_commitment_words

Build the Ed25519 fixed-64 message in RHDL, without hashing on the host.