GnuPG: Why is my Ed25519 signature 144 bytes long rather than 64?

Question

according to https://www.rfc-editor.org/rfc/rfc8032

EdDSA uses small public keys (32 or 57 bytes) and signatures (64 or 
114 bytes) for Ed25519 and Ed448, respectively;

But if I sign using Ed25519 in GPG, my signature gets 144 bytes long:

$ gpg --list-keys
/c/Users/John/.gnupg/pubring.kbx
------------------------------------
pub   ed25519 2021-02-26 [SC] [expires: 2024-02-26]
      5D36E7C775DD890CC342A38EAA05320C465CBDC8
uid           [ultimate] John Doe
sub   cv25519 2021-02-26 [E] [expires: 2024-02-26]

$ echo "test" | gpg --sign -a --default-key 5D36E7C775DD890CC342A38EAA05320C465CBDC8 
gpg: using "5D36E7C775DD890CC342A38EAA05320C465CBDC8" as default secret key for signing
-----BEGIN PGP MESSAGE-----

owGbwMvMwCG2itWIxy1m7wnG09xJDAkW9z1LUotLuDpKWRjEOBhkxRRZYs2eHy+9
28lz2GlxH0wxKxNIJQMXpwBMpLqMkeHRubiENY5d012eXfJuLpnk8byifbVzrkCW
5VrhhcL/LY0YGV5/i3jWzSo4k1Fia6EEo4DZ+X+zD8yfbtP74NchS89NbpwA
=9T7d
-----END PGP MESSAGE-----

the decoded base64 string corresponds to 144bytes. I'd expect 64 bytes. What am I missing?

Answer 1

OpenPGP doesn't produce a raw Ed2519 signature. It includes additional data about what was signed, the hash that was used to pre-hash the data, the key that was used to sign it, and other information. For example, if you use gpg --list-packets on the signature file, you get this:

# off=0 ctb=a3 tag=8 hlen=1 plen=0 indeterminate
:compressed packet: algo=1
# off=2 ctb=90 tag=4 hlen=2 plen=13
:onepass_sig packet: keyid AA05320C465CBDC8
        version 3, sigclass 0x00, digest 8, pubkey 22, last=1
# off=17 ctb=cb tag=11 hlen=2 plen=11 new-ctb
:literal data packet:
        mode b (62), created 1614339913, name="",
        raw data: 5 bytes
# off=30 ctb=88 tag=2 hlen=2 plen=117
:signature packet: algo 22, keyid AA05320C465CBDC8
        version 4, created 1614339913, md5len 0, sigclass 0x00
        digest algo 8, begin of digest 7b 76
        hashed subpkt 33 len 21 (issuer fpr v4 5D36E7C775DD890CC342A38EAA05320C465CBDC8)
        hashed subpkt 2 len 4 (sig created 2021-02-26)
        subpkt 16 len 8 (issuer key ID AA05320C465CBDC8)
        data: [256 bits]
        data: [256 bits]

This indicates that there is a compressed packet, a one-pass signature packet (which is used to specify parameters used to allow implementations to compute the signature without seeking), a literal data packet (with the data "test\n"), and a signature packet. The signature packet indicates that this is a type 0x00 (binary data) signature using hash algorithm 8 (SHA-256) and created by key 5D36E7C775DD890CC342A38EAA05320C465CBDC8. There are two 256-bit values at the end, which are the Ed25519 signature itself.