AsymmetricRecommended
Ed25519 and EdDSA
Digital signatures
How it works
EdDSA is a signature scheme on twisted Edwards curves; Ed25519 is its most common instance. The per-signature nonce is derived deterministically from the private key and the message, so signing does not depend on a good random number generator. It was added to FIPS 186-5 in 2023.
Sizes: Ed25519: 32-byte public key, 64-byte signature, about 128-bit security. Ed448 also defined
Strengths
- Fast signing and verification with small keys and signatures.
- Deterministic nonces remove ECDSA's nonce-reuse failure mode.
- Designed for constant-time implementation.
Weaknesses and known attacks
- Fault attacks on deterministic signing are possible on hardware an attacker can physically manipulate.
- Vulnerable to Shor's algorithm on a large quantum computer.
Use it for
- SSH keys
- Software and package signing
- New protocol designs needing signatures
Don't use it for
- Encryption or key agreement (use X25519 for that)
Exam tip
Ed25519 is a signature algorithm; X25519 is the key-agreement function on the related curve. Same curve family, different jobs.