Encryption & Keys

What Is Ed25519 (EdDSA)?

Ed25519 is a modern elliptic-curve signature algorithm (EdDSA over Curve25519) offering ~128-bit security with tiny 32-byte keys and 64-byte signatures, high speed, and a design that eliminates the classic implementation pitfalls of ECDSA. It has become the default for SSH keys and is standard in modern protocols — while TLS certificates still mostly use RSA and ECDSA because the public web’s CA infrastructure lags behind.

Why cryptographers prefer it

ECDSA requires a perfect random nonce for every signature — a repeated or biased nonce leaks the private key (how the PlayStation 3 signing key fell). Ed25519 signs deterministically, removing that entire failure class, and the curve arithmetic is naturally constant-time, closing timing side channels. Same security, fewer ways to die.

Where you can use it today

SSH (ssh-keygen -t ed25519 is the recommended default), signify/minisign-style file signing, JWTs (EdDSA), DNSSEC, and TLS 1.3 supports Ed25519 signatures in principle. The gap is the public certificate ecosystem: the CA/Browser Forum Baseline Requirements do not yet allow Ed25519 in publicly trusted certificates, so web TLS remains RSA/ECDSA. Private PKIs can issue Ed25519 certificates today if every client is known to support them.

Generating and inspecting Ed25519 keys

OpenSSL handles Ed25519 natively:

openssl genpkey -algorithm ed25519 -out key.pem
openssl pkey -in key.pem -pubout

Try it yourself — free tools

Key Matcher — verify an Ed25519 key against a certificate or CSR
CSR Decoder & Analyzer — see the signature algorithm a CSR actually uses

How MI Support IT can help

PKI Tools is built by MI Support IT, a Danish IT company with deep specialization in enterprise PKI: ADCS design and health checks, Venafi certificate automation, key ceremonies and CP/CPS documentation. Read about our PKI services or get in touch.