Ed25519.

Ed25519 is the most widely deployed instance of the Edwards-curve Digital Signature Algorithm (EdDSA), specified in RFC 8032. It uses the twisted Edwards curve edwards25519 (birationally equivalent to Curve25519) over the prime field 2²⁵⁵ − 19, producing 32-byte public keys and 64-byte signatures with roughly 128 bits of security. Signing is deterministic: the per-signature nonce is derived from the private key and message via SHA-512, eliminating the catastrophic nonce-reuse failure that broke Sony's PlayStation 3 code-signing and the Android Bitcoin wallets that reused ECDSA k values.

In February 2023, NIST added EdDSA (Ed25519 and Ed448) to FIPS 186-5, ending a long period in which the scheme was ubiquitous in practice but not FIPS-approved — a gap that had kept it out of some regulated deployments. Ed25519 is now the default in OpenSSH, WireGuard, GnuPG, TLS 1.3, Signal, and modern code-signing systems.

A subtle pitfall is verification semantics. Because the curve has cofactor 8, implementations disagree on whether to accept small-order points and whether verification is cofactored — so a signature that one library accepts another may reject, and some allow malleable variants. The 2020 paper "Taming the Many EdDSA" (Chalkias, Garillot, Nikolaenko) catalogued these divergences, which matter for consensus systems like blockchains (Solana, Cardano) where every validator must agree bit-for-bit. RFC 8032 recommends the stricter checks; libraries such as libsodium enforce them by default.

flowchart TD
  SK["Private seed"] -->|SHA-512| H["Hash h0..h63"]
  H --> A["Scalar a, public key A = a*B"]
  H --> PR["Prefix bytes"]
  PR --> R["r = SHA-512(prefix, M)"]
  R --> RP["R = r*B"]
  RP --> S["S = r + SHA-512(R, A, M)*a"]
  S --> SIG["Signature = R, S<br/>64 bytes, deterministic"]
  SIG --> V{"Verify:<br/>8*S*B == 8*R + 8*h*A ?"}
  A --> V
  V -->|yes| OK["Valid"]
  V -->|no| BAD["Reject"]