Ed25519 (EdDSA over Curve25519)

Ed25519 is an instance of EdDSA, the Edwards-curve Digital Signature Algorithm, specified in RFC 8032. It offers about 128-bit security, is designed for fast constant-time implementation, and derives its per-signature nonce deterministically from the key and message, avoiding the random-nonce failures that have leaked ECDSA keys. RFC 8410 defines its use in X.509 certificates, TLS 1.3 includes an ed25519 signature scheme, and NIST added EdDSA to FIPS 186-5.

Why it matters

Ed25519 is the default choice for SSH keys and is common in software signing and other protocols. For public websites the situation differs: as of November 2026, WebPKI CAs issue TLS certificates with RSA and ECDSA (P-256/P-384) keys, so Ed25519 server certificates are found in private PKI, where you control both the CA and the clients. Like other elliptic-curve schemes it is not quantum-resistant; ML-DSA is the standardized post-quantum signature counterpart.

Example

Create an Ed25519 key, a self-signed certificate for an internal service, and an SSH key:

openssl genpkey -algorithm ED25519 -out ed25519.key
openssl req -new -x509 -key ed25519.key -days 30 -subj "/CN=internal.example.com" -out ed25519.crt
ssh-keygen -t ed25519 -C "deploy@example.com"

Common misconceptions

• "Ed25519 and X25519 are the same thing." They are built on the same underlying curve but serve different purposes: Ed25519 signs, X25519 performs key exchange.
• "I can get a publicly trusted Ed25519 certificate for my website." Public CAs issue RSA and ECDSA certificates for TLS; use Ed25519 within private PKI.
• "Ed25519 is post-quantum." It is elliptic-curve cryptography and would fall to Shor's algorithm like ECDSA and RSA.