Archivecryptography
What Ed25519 Gets Right
Deterministic nonces, a cofactor-safe verification equation, and small keys — the modern default for signatures.
- Published
- Reading time
- 1 min read
Ed25519 is the Edwards-curve signature scheme most new systems should use. It is not just "ECDSA on another curve"; several design decisions remove entire failure classes.
The decisions
- Deterministic nonce: derived as
H(prefix || message)instead of random. No RNG failure, no nonce-reuse key recovery — the bug class that killed Sony's PS3. - Verification equation: uses the cofactor-cleared form, so small-subgroup keys cannot cause key-substitution attacks.
- Encoding: 32-byte keys and 64-byte signatures, with canonical point encoding enforced.
- Hashing built in: SHA-512 internally; no configurable hash to get wrong.
Limits
Ed25519 is not a KEM or key-exchange. It also assumes a prime-order-group setting; the related X25519 handles key agreement. And pure Ed25519 is not strongly unforgeable under some exotic models — protocols that need that property must bind context themselves.
Takeaway: for signatures on new designs, Ed25519 removes footguns ECDSA keeps. Pair it with X25519 for key agreement.