Ed448

Ed448 is an elliptic-curve digital signature scheme (EdDSA) built on the Edwards-curve Ed448-Goldilocks. It uses the SHAKE256 hash function as part of its signing and verification process and provides a high level of security with signatures and public keys larger than those used by Ed25519. The curve operates over a prime field p = 2^448 − 2^224 − 1 and has a large order l, yielding an estimated security level around 224 bits. Public keys are encoded in 57 bytes and signatures in 114 bytes.

Ed448 comes in two variants. The standard Ed448 signs raw messages and is specified alongside Ed448ph, a pre-hashed variant that signs the result of hashing the message with SHAKE256 prior to signing. These variants are described in formal standards documents and are designed to accommodate different application needs, such as long messages or environments where prehashing is desirable.

The scheme is part of the EdDSA family and is designed to be deterministic: signatures are derived deterministically from the private key and message hash, avoiding the need for a random nonce. This reduces certain classes of side-channel risks and simplifies security proofs. Verifying a signature on Ed448 uses the public key, the signature, and the message (or its prehash, in the ed448ph case) to confirm authenticity without exposing private material.

Ed448 is standardized in the EdDSA family and supported by multiple cryptographic libraries and tools, including modern implementations of OpenSSL, Libsodium, and related software. It is chosen for high-security applications where longer key and signature sizes are acceptable in exchange for stronger cryptographic guarantees.