Ed25519: high-speed high-security signatures
The official Ed25519 site by Bernstein, Duif, Lange, Schwabe, and Yang: an EdDSA elliptic-curve signature scheme over edwards25519 with 128-bit security, deterministic nonces, 32-byte keys, and 64-byte signatures.
Overview
Ed25519 is a public-key digital signature system authored by Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, and Bo-Yin Yang, documented at ed25519.cr.yp.to and in their paper “High-speed high-security signatures”. It is the EdDSA (Edwards-curve Digital Signature Algorithm) instantiation over the twisted Edwards curve edwards25519, a birationally equivalent form of Curve25519 defined over the prime field of 2^255 - 19, using SHA-512 as its internal hash. The design targets fast signing, fast single and batch verification, and a roughly 128-bit security level while eliminating common implementation pitfalls. Ed25519 was later standardized as EdDSA in RFC 8032 and is widely deployed in TLS, SSH, and other protocols.
Key points
- Deterministic nonces: the per-signature secret value is derived by hashing the message together with the secret key, so signing needs no per-message randomness and avoids the catastrophic key leakage that struck DSA/ECDSA implementations with weak random number generators.
- Compact sizes: 32-byte public keys and 64-byte signatures, with fast key generation.
- Security level around 2^128, described as comparable to a much larger RSA modulus, and the system is collision-resilient so that hash-function collisions alone do not break it.
- Side-channel resistance by construction: implementations use no secret-dependent branches and no secret-dependent array indices or memory addresses, defeating timing and cache attacks.
- High throughput: the authors report signing and verification on the order of tens of thousands of operations per second on commodity CPUs, with batch verification further increasing verification rates.
- Built on well-studied primitives: the edwards25519 curve, complete twisted-Edwards addition formulas, and SHA-512.
Relevance to Truestamp
Truestamp signs its published records with Ed25519, so a verifier can confirm authenticity offline using only the public key. See Ed25519 signatures for how the signature scheme is applied within Truestamp’s proof and commitment flows.
Citations
- Ed25519: high-speed high-security signatures. Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, and Bo-Yin Yang; standardized as EdDSA in RFC 8032.