ed25519

Ed25519 is a public-key digital signature scheme based on the Twisted Edwards form of Curve25519. It is designed for fast operation, compact keys, and strong security, and is described in RFC 8032 as Ed25519. The public key is 32 bytes and the signature is 64 bytes; the private key is typically a 32-byte seed used to derive a secret scalar and a per-message nonce.

Signing is deterministic and does not require random numbers. The signer uses SHA-512 to expand the private key seed into a secret scalar a and a prefix. For a message M, a per-message nonce r is derived from the prefix and M; the point R = rB is computed on the curve, where B is the base point. A hash h = H(R || A || M) is then formed, and the scalar s = (r + h a) modulo the order L of the base point. The signature is the concatenation of R and s. Verification checks that sB = R + hA, where A is the public key.

Ed25519 operates with a cofactor of 8 and uses a prime-order subgroup of size roughly 2^252. The scheme is designed to be fast in software, with constant-time implementations to resist side-channel attacks. It is not the same as Curve25519 used for Diffie-Hellman, though they share the same underlying curve.

Ed25519 has seen widespread adoption in secure communications and software signing; it is supported by many cryptographic libraries and protocols, including TLS, SSH, and various secure messaging systems. A variant, Ed25519ph, applies a pre-hash of the message before signing.