EdDSA

<h2 id="summary">Summary</h2>
The following is a simplified description of EdDSA, ignoring details of encoding integers and curve points as bit strings; the full details are in the papers and RFC.<a class="footnote-ref" id="fnref:4" href="#fn:4">4</a><a class="footnote-ref" id="fnref:5" href="#fn:5">5</a><a class="footnote-ref" id="fnref:6" href="#fn:6">6</a>
An EdDSA signature scheme is a choice:<a class="footnote-ref" id="fnref:7" href="#fn:7">7</a>: 1–2 <a class="footnote-ref" id="fnref:8" href="#fn:8">8</a>: 5–6 <a class="footnote-ref" id="fnref:9" href="#fn:9">9</a>: 5–7 

<ul><li>of <a href="/facts/Finite_field/UkMGJo3m">finite field</a> 
 
 
 
 
 
 F
 
 
 q
 
 
 
 
 {\displaystyle \mathbb {F} _{q}}
 
 over odd prime power 
 
 
 
 q
 
 
 {\displaystyle q}
 
;</li>
<li>of <a href="/facts/Elliptic-curve_cryptography/YbjcXIWk">elliptic curve</a> 
 
 
 
 E
 
 
 {\displaystyle E}
 
 over 
 
 
 
 
 
 F
 
 
 q
 
 
 
 
 {\displaystyle \mathbb {F} _{q}}
 
 whose group 
 
 
 
 E
 (
 
 
 F
 
 
 q
 
 
 )
 
 
 {\displaystyle E(\mathbb {F} _{q})}
 
 of <a href="/facts/Rational_point/j5v4cxuE">
 
 
 
 
 
 F
 
 
 q
 
 
 
 
 {\displaystyle \mathbb {F} _{q}}
 
-rational points</a> has order 
 
 
 
 #
 E
 (
 
 
 F
 
 
 q
 
 
 )
 =
 
 2
 
 c
 
 
 ℓ
 
 
 {\displaystyle \#E(\mathbb {F} _{q})=2^{c}\ell }
 
, where 
 
 
 
 ℓ
 
 
 {\displaystyle \ell }
 
 is a large prime and 
 
 
 
 
 2
 
 c
 
 
 
 
 {\displaystyle 2^{c}}
 
 is called the cofactor;</li>
<li>of base point 
 
 
 
 B
 ∈
 E
 (
 
 
 F
 
 
 q
 
 
 )
 
 
 {\displaystyle B\in E(\mathbb {F} _{q})}
 
 with order 
 
 
 
 ℓ
 
 
 {\displaystyle \ell }
 
; and</li>
<li>of <a href="/facts/Cryptographic_hash_function/cuxkgbST">cryptographic hash function</a> 
 
 
 
 H
 
 
 {\displaystyle H}
 
 with 
 
 
 
 2
 b
 
 
 {\displaystyle 2b}
 
-bit outputs, where 
 
 
 
 
 2
 
 b
 −
 1
 
 
 >
 q
 
 
 {\displaystyle 2^{b-1}>q}
 
 so that elements of 
 
 
 
 
 
 F
 
 
 q
 
 
 
 
 {\displaystyle \mathbb {F} _{q}}
 
 and curve points in 
 
 
 
 E
 (
 
 
 F
 
 
 q
 
 
 )
 
 
 {\displaystyle E(\mathbb {F} _{q})}
 
 can be represented by strings of 
 
 
 
 b
 
 
 {\displaystyle b}
 
 bits.</li></ul>
These parameters are common to all users of the EdDSA signature scheme. The security of the EdDSA signature scheme depends critically on the choices of parameters, except for the arbitrary choice of base point—for example, <a href="/facts/Pollard%2527s_rho_algorithm_for_logarithms/UFayJQrH">Pollard's rho algorithm for logarithms</a> is expected to take approximately 
 
 
 
 
 
 ℓ
 π
 
 /
 
 4
 
 
 
 
 {\displaystyle {\sqrt {\ell \pi /4}}}
 
 curve additions before it can compute a discrete logarithm,<a class="footnote-ref" id="fnref:10" href="#fn:10">10</a> so 
 
 
 
 ℓ
 
 
 {\displaystyle \ell }
 
 must be large enough for this to be infeasible, and is typically taken to exceed 2200.<a class="footnote-ref" id="fnref:11" href="#fn:11">11</a>
The choice of 
 
 
 
 ℓ
 
 
 {\displaystyle \ell }
 
 is limited by the choice of 
 
 
 
 q
 
 
 {\displaystyle q}
 
, since by <a href="/facts/Hasse%2527s_theorem_on_elliptic_curves/HDvvYpjX">Hasse's theorem</a>, 
 
 
 
 #
 E
 (
 
 
 F
 
 
 q
 
 
 )
 =
 
 2
 
 c
 
 
 ℓ
 
 
 {\displaystyle \#E(\mathbb {F} _{q})=2^{c}\ell }
 
 cannot differ from 
 
 
 
 q
 +
 1
 
 
 {\displaystyle q+1}
 
 by more than 
 
 
 
 2
 
 
 q
 
 
 
 
 {\displaystyle 2{\sqrt {q}}}
 
. The hash function 
 
 
 
 H
 
 
 {\displaystyle H}
 
 is normally modelled as a <a href="/facts/Random_oracle/wK7MhxDq">random oracle</a> in formal analyses of EdDSA's security.
Within an EdDSA signature scheme,

Public key
An EdDSA public key is a curve point 
 
 
 
 A
 ∈
 E
 (
 
 
 F
 
 
 q
 
 
 )
 
 
 {\displaystyle A\in E(\mathbb {F} _{q})}
 
, encoded in 
 
 
 
 b
 
 
 {\displaystyle b}
 
 bits.
Signature verification
An EdDSA signature on a message 
 
 
 
 M
 
 
 {\displaystyle M}
 
 by public key 
 
 
 
 A
 
 
 {\displaystyle A}
 
 is the pair 
 
 
 
 (
 R
 ,
 S
 )
 
 
 {\displaystyle (R,S)}
 
, encoded in 
 
 
 
 2
 b
 
 
 {\displaystyle 2b}
 
 bits, of a curve point 
 
 
 
 R
 ∈
 E
 (
 
 
 F
 
 
 q
 
 
 )
 
 
 {\displaystyle R\in E(\mathbb {F} _{q})}
 
 and an integer 
 
 
 
 0
 <
 S
 <
 ℓ
 
 
 {\displaystyle 0<S<\ell }
 
 satisfying the following verification equation, where 
 
 
 
 ∥
 
 
 {\displaystyle \parallel }
 
 denotes <a href="/facts/Concatenation/1npYg6rc">concatenation</a>:

 
 
 
 
 2
 
 c
 
 
 S
 B
 =
 
 2
 
 c
 
 
 R
 +
 
 2
 
 c
 
 
 H
 (
 R
 ∥
 A
 ∥
 M
 )
 A
 .
 
 
 {\displaystyle 2^{c}SB=2^{c}R+2^{c}H(R\parallel A\parallel M)A.}

Private key
An EdDSA private key is a 
 
 
 
 b
 
 
 {\displaystyle b}
 
-bit string 
 
 
 
 k
 
 
 {\displaystyle k}
 
 which should be chosen uniformly at random. The corresponding public key is 
 
 
 
 A
 =
 s
 B
 
 
 {\displaystyle A=sB}
 
, where 
 
 
 
 s
 =
 
 H
 
 0
 ,
 …
 ,
 b
 −
 1
 
 
 (
 k
 )
 
 
 {\displaystyle s=H_{0,\dots ,b-1}(k)}
 
 is the least significant 
 
 
 
 b
 
 
 {\displaystyle b}
 
 bits of 
 
 
 
 H
 (
 k
 )
 
 
 {\displaystyle H(k)}
 
 interpreted as an integer in <a href="/facts/Little-endian/wbrQnyu3">little-endian</a>.
Signing
The signature on a message 
 
 
 
 M
 
 
 {\displaystyle M}
 
 is deterministically computed as 
 
 
 
 (
 R
 ,
 S
 )
 ,
 
 
 {\displaystyle (R,S),}
 
 where 
 
 
 
 R
 =
 r
 B
 
 
 {\displaystyle R=rB}
 
 for 
 
 
 
 r
 =
 H
 (
 
 H
 
 b
 ,
 …
 ,
 2
 b
 −
 1
 
 
 (
 k
 )
 ∥
 M
 )
 
 
 {\displaystyle r=H(H_{b,\dots ,2b-1}(k)\parallel M)}
 
, and 
 
 
 
 S
 ≡
 r
 +
 H
 (
 R
 ∥
 A
 ∥
 M
 )
 s
 
 
 (
 mod
 
 ℓ
 )
 
 .
 
 
 {\displaystyle S\equiv r+H(R\parallel A\parallel M)s{\pmod {\ell }}.}
 
 This satisfies the verification equation

 
 
 
 
 
 
 
 
 2
 
 c
 
 
 S
 B
 
 
 
 =
 
 2
 
 c
 
 
 (
 r
 +
 H
 (
 R
 ∥
 A
 ∥
 M
 )
 s
 )
 B
 
 
 
 
 
 
 =
 
 2
 
 c
 
 
 r
 B
 +
 
 2
 
 c
 
 
 H
 (
 R
 ∥
 A
 ∥
 M
 )
 s
 B
 
 
 
 
 
 
 =
 
 2
 
 c
 
 
 R
 +
 
 2
 
 c
 
 
 H
 (
 R
 ∥
 A
 ∥
 M
 )
 A
 .
 
 
 
 
 
 
 {\displaystyle {\begin{aligned}2^{c}SB&=2^{c}(r+H(R\parallel A\parallel M)s)B\\&=2^{c}rB+2^{c}H(R\parallel A\parallel M)sB\\&=2^{c}R+2^{c}H(R\parallel A\parallel M)A.\end{aligned}}}

<h2 id="ed25519">Ed25519</h2>
Ed25519 is the EdDSA signature scheme using <a href="/facts/SHA-512/P59oPeGq">SHA-512</a> (SHA-2) and an elliptic curve related to <a href="/facts/Curve25519/wLr6FMkV">Curve25519</a><a class="footnote-ref" id="fnref:12" href="#fn:12">12</a> where

<ul><li>
 
 
 
 q
 =
 
 2
 
 255
 
 
 −
 19
 ,
 
 
 {\displaystyle q=2^{255}-19,}
 
</li>
<li>
 
 
 
 E
 
 /
 
 
 
 F
 
 
 q
 
 
 
 
 {\displaystyle E/\mathbb {F} _{q}}
 
 is the <a href="/facts/Twisted_Edwards_curve/mz1EMMNL">twisted Edwards curve</a></li></ul>

 
 
 
 −
 
 x
 
 2
 
 
 +
 
 y
 
 2
 
 
 =
 1
 −
 
 
 121665
 121666
 
 
 
 x
 
 2
 
 
 
 y
 
 2
 
 
 ,
 
 
 {\displaystyle -x^{2}+y^{2}=1-{\frac {121665}{121666}}x^{2}y^{2},}

<ul><li>
 
 
 
 ℓ
 =
 
 2
 
 252
 
 
 +
 27742317777372353535851937790883648493
 
 
 {\displaystyle \ell =2^{252}+27742317777372353535851937790883648493}
 
 and 
 
 
 
 c
 =
 3
 
 
 {\displaystyle c=3}
 
</li>
<li>
 
 
 
 B
 
 
 {\displaystyle B}
 
 is the unique point in 
 
 
 
 E
 (
 
 
 F
 
 
 q
 
 
 )
 
 
 {\displaystyle E(\mathbb {F} _{q})}
 
 whose 
 
 
 
 y
 
 
 {\displaystyle y}
 
 coordinate is 
 
 
 
 4
 
 /
 
 5
 
 
 {\displaystyle 4/5}
 
 and whose 
 
 
 
 x
 
 
 {\displaystyle x}
 
 coordinate is positive."positive" is defined in terms of bit-encoding:
<ul><li>"positive" coordinates are even coordinates (least significant bit is cleared)</li>
<li>"negative" coordinates are odd coordinates (least significant bit is set)</li></ul></li>
<li>
 
 
 
 H
 
 
 {\displaystyle H}
 
 is <a href="/facts/SHA-512/P59oPeGq">SHA-512</a>, with 
 
 
 
 b
 =
 256
 
 
 {\displaystyle b=256}
 
.</li></ul>
The <a href="/facts/Twisted_Edwards_curve/mz1EMMNL">twisted Edwards curve</a> 
 
 
 
 E
 
 /
 
 
 
 F
 
 
 q
 
 
 
 
 {\displaystyle E/\mathbb {F} _{q}}
 
 is known as edwards25519,<a class="footnote-ref" id="fnref:13" href="#fn:13">13</a><a class="footnote-ref" id="fnref:14" href="#fn:14">14</a> and is <a href="/facts/Birationally_equivalent/hsWqRhJ1">birationally equivalent</a> to the <a href="/facts/Montgomery_curve/YQWgbzVp">Montgomery curve</a> known as <a href="/facts/Curve25519/wLr6FMkV">Curve25519</a>.
The equivalence is<a class="footnote-ref" id="fnref:15" href="#fn:15">15</a><a class="footnote-ref" id="fnref:16" href="#fn:16">16</a><a class="footnote-ref" id="fnref:17" href="#fn:17">17</a>

x
        =
        
          
            u
            v
          
        
        
          
            −
            486664
          
        
        ,
        
        y
        =
        
          
            
              u
              −
              1
            
            
              u
              +
              1
            
          
        
        .
      
    
    {\displaystyle x={\frac {u}{v}}{\sqrt {-486664}},\quad y={\frac {u-1}{u+1}}.}

<h3>Performance</h3>
The original team has optimized Ed25519 for the <a href="/facts/X86-64/cyWvUFlP">x86-64</a> <a href="/facts/Nehalem_(microarchitecture)/UPsI457h">Nehalem</a>/<a href="/facts/Westmere_(microarchitecture)/yB4HcYdY">Westmere</a> processor family. Verification can be performed in batches of 64 signatures for even greater throughput. Ed25519 is intended to provide attack resistance comparable to quality 128-bit <a href="/facts/Symmetric-key_algorithm/5zfe0b76">symmetric ciphers</a>.<a class="footnote-ref" id="fnref:18" href="#fn:18">18</a>
Public keys are 256 bits long and signatures are 512 bits long.<a class="footnote-ref" id="fnref:19" href="#fn:19">19</a>

<h3>Secure coding</h3>
Ed25519 is designed to avoid implementations that use branch conditions or array indices that depend on secret data,<a class="footnote-ref" id="fnref:20" href="#fn:20">20</a>: 2 <a class="footnote-ref" id="fnref:21" href="#fn:21">21</a>: 40  in order to mitigate <a href="/facts/Side-channel_attack/2B1dfBty">side-channel attacks</a>.
As with other discrete-log-based signature schemes, EdDSA uses a secret value called a <a href="/facts/Cryptographic_nonce/ENHRCGnw">nonce</a> unique to each signature. In the signature schemes <a href="/facts/Digital_Signature_Algorithm/0o0FK486">DSA</a> and <a href="/facts/ECDSA/gl0mfnS1">ECDSA</a>, this nonce is traditionally generated randomly for each signature—and if the random number generator is ever broken and predictable when making a signature, the signature can leak the private key, as happened with the <a href="/facts/Sony_PlayStation_3/obhuo97V">Sony PlayStation 3</a> firmware update signing key.<a class="footnote-ref" id="fnref:22" href="#fn:22">22</a><a class="footnote-ref" id="fnref:23" href="#fn:23">23</a><a class="footnote-ref" id="fnref:24" href="#fn:24">24</a><a class="footnote-ref" id="fnref:25" href="#fn:25">25</a>
In contrast, EdDSA chooses the nonce deterministically as the hash of a part of the private key and the message. Thus, once a private key is generated, EdDSA has no further need for a random number generator in order to make signatures, and there is no danger that a broken random number generator used to make a signature will reveal the private key.<a class="footnote-ref" id="fnref:26" href="#fn:26">26</a>: 8 

<h3>Standardization and implementation inconsistencies</h3>
Note that there are two standardization efforts for EdDSA, one from IETF, an informational <a href="/facts/RFC_(identifier)/esftTvE7">RFC</a> <a href="https://www.rfc-editor.org/rfc/rfc8032">8032</a> and one from NIST as part of FIPS 186-5.<a class="footnote-ref" id="fnref:27" href="#fn:27">27</a> The differences between the standards have been analyzed,<a class="footnote-ref" id="fnref:28" href="#fn:28">28</a><a class="footnote-ref" id="fnref:29" href="#fn:29">29</a> and test vectors are available.<a class="footnote-ref" id="fnref:30" href="#fn:30">30</a>

<h3>Software</h3>
Notable uses of Ed25519 include <a href="/facts/OpenSSH/2qxJ3Fe7">OpenSSH</a>,<a class="footnote-ref" id="fnref:31" href="#fn:31">31</a> <a href="/facts/GnuPG/EqmGmx7V">GnuPG</a><a class="footnote-ref" id="fnref:32" href="#fn:32">32</a> and various alternatives, and the <a href="/facts/Signify_(OpenBSD)/pzh5KSFl">signify</a> tool by <a href="/facts/OpenBSD/xmPS9tek">OpenBSD</a>.<a class="footnote-ref" id="fnref:33" href="#fn:33">33</a> Usage of Ed25519 (and Ed448) in the SSH protocol has been standardized.<a class="footnote-ref" id="fnref:34" href="#fn:34">34</a> In 2023 the final version of the <a href="/facts/Federal_Information_Processing_Standards/n0Ll7hpQ">FIPS</a> 186-5 standard included deterministic Ed25519 as an approved signature scheme.<a class="footnote-ref" id="fnref:35" href="#fn:35">35</a>

<ul><li><a href="/facts/Apple_Watch/tJjbXQEa">Apple Watch</a> and <a href="/facts/IPhone/h5WeKRl9">iPhone</a> use Ed25519 keys for <a href="/facts/IKEv2/QBvx8mgk">IKEv2</a> mutual authentication<a class="footnote-ref" id="fnref:36" href="#fn:36">36</a></li>
<li><a href="/facts/Botan_(programming_library)/IehRkvcn">Botan</a></li>
<li><a href="/facts/Crypto%252B%252B/cCWAwUmX">Crypto++</a></li>
<li><a href="/facts/CryptoNote/tK691ht0">CryptoNote</a> <a href="/facts/Cryptocurrency/Rg6JAS8y">cryptocurrency</a> <a href="/facts/Cryptographic_protocol/0WuyTkFo">protocol</a></li>
<li><a href="/facts/Dropbear_(software)/Y8GdfWhh">Dropbear SSH</a><a class="footnote-ref" id="fnref:37" href="#fn:37">37</a></li>
<li>I2Pd implementation of EdDSA<a class="footnote-ref" id="fnref:38" href="#fn:38">38</a></li>
<li><a href="/facts/Java_Development_Kit/qL5cDos6">Java Development Kit</a> 15</li>
<li><a href="/facts/Libgcrypt/Fsj9wNw3">Libgcrypt</a></li>
<li>Minisign<a class="footnote-ref" id="fnref:39" href="#fn:39">39</a> and Minisign Miscellanea<a class="footnote-ref" id="fnref:40" href="#fn:40">40</a> for <a href="/facts/MacOS/Y93vVpTm">macOS</a></li>
<li><a href="/facts/NaCl_(software)/0J9zoeHH">NaCl / libsodium</a><a class="footnote-ref" id="fnref:41" href="#fn:41">41</a></li>
<li><a href="/facts/OpenSSL/aXvs5fo2">OpenSSL</a> 1.1.1<a class="footnote-ref" id="fnref:42" href="#fn:42">42</a></li>
<li><a href="/facts/Python_(programming_language)/YbuGqofa">Python</a> - A slow but concise alternate implementation,<a class="footnote-ref" id="fnref:43" href="#fn:43">43</a> does not include <a href="/facts/Side-channel_attack/2B1dfBty">side-channel attack</a> protection<a class="footnote-ref" id="fnref:44" href="#fn:44">44</a></li>
<li>Supercop reference implementation<a class="footnote-ref" id="fnref:45" href="#fn:45">45</a> (<a href="/facts/C_language/Ky2No763">C language</a> with inline <a href="/facts/Assembler_(computing)/7XuV0cla">assembler</a>)</li>
<li>Virgil PKI uses Ed25519 keys by default<a class="footnote-ref" id="fnref:46" href="#fn:46">46</a></li>
<li><a href="/facts/WolfSSL/26UD7dQE">wolfSSL</a><a class="footnote-ref" id="fnref:47" href="#fn:47">47</a></li></ul>
<h2 id="ed448">Ed448</h2>
Ed448 is the EdDSA signature scheme defined in <a href="/facts/RFC_(identifier)/esftTvE7">RFC</a> <a href="https://www.rfc-editor.org/rfc/rfc8032">8032</a> using the hash function <a href="/facts/SHAKE256/bA3BCp7K">SHAKE256</a> and the elliptic curve edwards448, an (untwisted) <a href="/facts/Edwards_curve/zk5Vy1xl">Edwards curve</a> related to <a href="/facts/Curve448/gsN24bb9">Curve448</a> in <a href="/facts/RFC_(identifier)/esftTvE7">RFC</a> <a href="https://www.rfc-editor.org/rfc/rfc7748">7748</a>.
Ed448 has also been approved in the final version of the FIPS 186-5 standard.<a class="footnote-ref" id="fnref:48" href="#fn:48">48</a>

<h2 id="external-links">External links</h2>
<ul><li><a href="https://ed25519.cr.yp.to/">Ed25519 home page</a></li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1">Josefsson, S.; Liusvaara, I. (January 2017). Edwards-Curve Digital Signature Algorithm (EdDSA). IRTF. doi:10.17487/RFC8032. ISSN 2070-1721. RFC 8032. Retrieved 2022-07-11. <a href="https://datatracker.ietf.org/doc/html/rfc8032" target="_blank">https://datatracker.ietf.org/doc/html/rfc8032</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></li>
<li id="fn:2">Bernstein, Daniel J.; Duif, Niels; Lange, Tanja; Schwabe, Peter; Bo-Yin Yang (2012). "High-speed high-security signatures" (PDF). Journal of Cryptographic Engineering. 2 (2): 77–89. doi:10.1007/s13389-012-0027-1. S2CID 945254. <a href="/wiki/Daniel_J._Bernstein" target="_blank">/wiki/Daniel_J._Bernstein</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></li>
<li id="fn:3">"Software". 2015-06-11. Retrieved 2016-10-07. The Ed25519 software is in the public domain. <a href="https://ed25519.cr.yp.to/software.html" target="_blank">https://ed25519.cr.yp.to/software.html</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></li>
<li id="fn:4">Daniel J. Bernstein; Simon Josefsson; Tanja Lange; Peter Schwabe; Bo-Yin Yang (2015-07-04). EdDSA for more curves (PDF) (Technical report). Retrieved 2016-11-14. <a href="https://ed25519.cr.yp.to/eddsa-20150704.pdf" target="_blank">https://ed25519.cr.yp.to/eddsa-20150704.pdf</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></li>
<li id="fn:5">Bernstein, Daniel J.; Duif, Niels; Lange, Tanja; Schwabe, Peter; Bo-Yin Yang (2012). "High-speed high-security signatures" (PDF). Journal of Cryptographic Engineering. 2 (2): 77–89. doi:10.1007/s13389-012-0027-1. S2CID 945254. <a href="/wiki/Daniel_J._Bernstein" target="_blank">/wiki/Daniel_J._Bernstein</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></li>
<li id="fn:6">Josefsson, S.; Liusvaara, I. (January 2017). Edwards-Curve Digital Signature Algorithm (EdDSA). IRTF. doi:10.17487/RFC8032. ISSN 2070-1721. RFC 8032. Retrieved 2022-07-11. <a href="https://datatracker.ietf.org/doc/html/rfc8032" target="_blank">https://datatracker.ietf.org/doc/html/rfc8032</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></li>
<li id="fn:7">Daniel J. Bernstein; Simon Josefsson; Tanja Lange; Peter Schwabe; Bo-Yin Yang (2015-07-04). EdDSA for more curves (PDF) (Technical report). Retrieved 2016-11-14. <a href="https://ed25519.cr.yp.to/eddsa-20150704.pdf" target="_blank">https://ed25519.cr.yp.to/eddsa-20150704.pdf</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></li>
<li id="fn:8">Bernstein, Daniel J.; Duif, Niels; Lange, Tanja; Schwabe, Peter; Bo-Yin Yang (2012). "High-speed high-security signatures" (PDF). Journal of Cryptographic Engineering. 2 (2): 77–89. doi:10.1007/s13389-012-0027-1. S2CID 945254. <a href="/wiki/Daniel_J._Bernstein" target="_blank">/wiki/Daniel_J._Bernstein</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></li>
<li id="fn:9">Josefsson, S.; Liusvaara, I. (January 2017). Edwards-Curve Digital Signature Algorithm (EdDSA). IRTF. doi:10.17487/RFC8032. ISSN 2070-1721. RFC 8032. Retrieved 2022-07-11. <a href="https://datatracker.ietf.org/doc/html/rfc8032" target="_blank">https://datatracker.ietf.org/doc/html/rfc8032</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></li>
<li id="fn:10">Daniel J. Bernstein; Tanja Lange; Peter Schwabe (2011-01-01). On the correct use of the negation map in the Pollard rho method (Technical report). IACR Cryptology ePrint Archive. 2011/003. Retrieved 2016-11-14. <a href="https://eprint.iacr.org/2011/003" target="_blank">https://eprint.iacr.org/2011/003</a> <a href="#fnref:10" class="footnote-back-ref">↩</a></li>
<li id="fn:11">Bernstein, Daniel J.; Lange, Tanja. "ECDLP Security: Rho". SafeCurves: choosing safe curves for elliptic-curve cryptography. Retrieved 2016-11-16. <a href="https://safecurves.cr.yp.to/rho.html" target="_blank">https://safecurves.cr.yp.to/rho.html</a> <a href="#fnref:11" class="footnote-back-ref">↩</a></li>
<li id="fn:12">Bernstein, Daniel J.; Duif, Niels; Lange, Tanja; Schwabe, Peter; Bo-Yin Yang (2012). "High-speed high-security signatures" (PDF). Journal of Cryptographic Engineering. 2 (2): 77–89. doi:10.1007/s13389-012-0027-1. S2CID 945254. <a href="/wiki/Daniel_J._Bernstein" target="_blank">/wiki/Daniel_J._Bernstein</a> <a href="#fnref:12" class="footnote-back-ref">↩</a></li>
<li id="fn:13">Langley, A.; Hamburg, M.; Turner, S. (January 2016). Elliptic Curves for Security. IETF. doi:10.17487/RFC7748. ISSN 2070-1721. RFC 7748. Retrieved 2024-11-12. <a href="https://datatracker.ietf.org/doc/html/rfc7748" target="_blank">https://datatracker.ietf.org/doc/html/rfc7748</a> <a href="#fnref:13" class="footnote-back-ref">↩</a></li>
<li id="fn:14">Josefsson, S.; Liusvaara, I. (January 2017). Edwards-Curve Digital Signature Algorithm (EdDSA). IRTF. doi:10.17487/RFC8032. ISSN 2070-1721. RFC 8032. Retrieved 2022-07-11. <a href="https://datatracker.ietf.org/doc/html/rfc8032" target="_blank">https://datatracker.ietf.org/doc/html/rfc8032</a> <a href="#fnref:14" class="footnote-back-ref">↩</a></li>
<li id="fn:15">Bernstein, Daniel J.; Duif, Niels; Lange, Tanja; Schwabe, Peter; Bo-Yin Yang (2012). "High-speed high-security signatures" (PDF). Journal of Cryptographic Engineering. 2 (2): 77–89. doi:10.1007/s13389-012-0027-1. S2CID 945254. <a href="/wiki/Daniel_J._Bernstein" target="_blank">/wiki/Daniel_J._Bernstein</a> <a href="#fnref:15" class="footnote-back-ref">↩</a></li>
<li id="fn:16">Langley, A.; Hamburg, M.; Turner, S. (January 2016). Elliptic Curves for Security. IETF. doi:10.17487/RFC7748. ISSN 2070-1721. RFC 7748. Retrieved 2024-11-12. <a href="https://datatracker.ietf.org/doc/html/rfc7748" target="_blank">https://datatracker.ietf.org/doc/html/rfc7748</a> <a href="#fnref:16" class="footnote-back-ref">↩</a></li>
<li id="fn:17">Bernstein, Daniel J.; Lange, Tanja (2007). Kurosawa, Kaoru (ed.). Faster addition and doubling on elliptic curves. Advances in cryptology—ASIACRYPT. Lecture Notes in Computer Science. Vol. 4833. Berlin: Springer. pp. 29–50. doi:10.1007/978-3-540-76900-2_3. ISBN 978-3-540-76899-9. MR 2565722. <a href="978-3-540-76899-9" target="_blank">978-3-540-76899-9</a> <a href="#fnref:17" class="footnote-back-ref">↩</a></li>
<li id="fn:18">Bernstein, Daniel J. (2017-01-22). "Ed25519: high-speed high-security signatures". Retrieved 2019-09-27. This system has a 2^128 security target; breaking it has similar difficulty to breaking NIST P-256, RSA with ~3000-bit keys, strong 128-bit block ciphers, etc. <a href="https://ed25519.cr.yp.to/" target="_blank">https://ed25519.cr.yp.to/</a> <a href="#fnref:18" class="footnote-back-ref">↩</a></li>
<li id="fn:19">Bernstein, Daniel J. (2017-01-22). "Ed25519: high-speed high-security signatures". Retrieved 2020-06-01. Signatures fit into 64 bytes. […] Public keys consume only 32 bytes. <a href="https://ed25519.cr.yp.to/" target="_blank">https://ed25519.cr.yp.to/</a> <a href="#fnref:19" class="footnote-back-ref">↩</a></li>
<li id="fn:20">Bernstein, Daniel J.; Duif, Niels; Lange, Tanja; Schwabe, Peter; Bo-Yin Yang (2012). "High-speed high-security signatures" (PDF). Journal of Cryptographic Engineering. 2 (2): 77–89. doi:10.1007/s13389-012-0027-1. S2CID 945254. <a href="/wiki/Daniel_J._Bernstein" target="_blank">/wiki/Daniel_J._Bernstein</a> <a href="#fnref:20" class="footnote-back-ref">↩</a></li>
<li id="fn:21">Josefsson, S.; Liusvaara, I. (January 2017). Edwards-Curve Digital Signature Algorithm (EdDSA). IRTF. doi:10.17487/RFC8032. ISSN 2070-1721. RFC 8032. Retrieved 2022-07-11. <a href="https://datatracker.ietf.org/doc/html/rfc8032" target="_blank">https://datatracker.ietf.org/doc/html/rfc8032</a> <a href="#fnref:21" class="footnote-back-ref">↩</a></li>
<li id="fn:22">Johnston, Casey (2010-12-30). "PS3 hacked through poor cryptography implementation". Ars Technica. Retrieved 2016-11-15. <a href="https://arstechnica.com/gaming/2010/12/ps3-hacked-through-poor-implementation-of-cryptography/" target="_blank">https://arstechnica.com/gaming/2010/12/ps3-hacked-through-poor-implementation-of-cryptography/</a> <a href="#fnref:22" class="footnote-back-ref">↩</a></li>
<li id="fn:23">fail0verflow (2010-12-29). Console Hacking 2010: PS3 Epic Fail (PDF). Chaos Communication Congress. Archived from the original (PDF) on 2018-10-26. Retrieved 2016-11-15. <a href="https://web.archive.org/web/20181026183945/https://events.ccc.de/congress/2010/Fahrplan/attachments/1780_27c3_console_hacking_2010.pdf" target="_blank">https://web.archive.org/web/20181026183945/https://events.ccc.de/congress/2010/Fahrplan/attachments/1780_27c3_console_hacking_2010.pdf</a> <a href="#fnref:23" class="footnote-back-ref">↩</a></li>
<li id="fn:24">"27th Chaos Communication Congress: Console Hacking 2010: PS3 Epic Fail" (PDF). Retrieved 2019-08-04. <a href="https://www.cs.cmu.edu/~dst/GeoHot/1780_27c3_console_hacking_2010.pdf" target="_blank">https://www.cs.cmu.edu/~dst/GeoHot/1780_27c3_console_hacking_2010.pdf</a> <a href="#fnref:24" class="footnote-back-ref">↩</a></li>
<li id="fn:25">Buchanan, Bill (2018-11-12). "Not Playing Randomly: The Sony PS3 and Bitcoin Crypto Hacks. Watch those random number generators". Medium. Archived from the original on 2018-11-30. Retrieved 2024-03-11. <a href="https://web.archive.org/web/20181130215509/https://medium.com/asecuritysite-when-bob-met-alice/not-playing-randomly-the-sony-ps3-and-bitcoin-crypto-hacks-c1fe92bea9bc" target="_blank">https://web.archive.org/web/20181130215509/https://medium.com/asecuritysite-when-bob-met-alice/not-playing-randomly-the-sony-ps3-and-bitcoin-crypto-hacks-c1fe92bea9bc</a> <a href="#fnref:25" class="footnote-back-ref">↩</a></li>
<li id="fn:26">Bernstein, Daniel J.; Duif, Niels; Lange, Tanja; Schwabe, Peter; Bo-Yin Yang (2012). "High-speed high-security signatures" (PDF). Journal of Cryptographic Engineering. 2 (2): 77–89. doi:10.1007/s13389-012-0027-1. S2CID 945254. <a href="/wiki/Daniel_J._Bernstein" target="_blank">/wiki/Daniel_J._Bernstein</a> <a href="#fnref:26" class="footnote-back-ref">↩</a></li>
<li id="fn:27">Moody, Dustin (2023-02-03). FIPS 186-5: Digital Signature Standard (DSS). NIST. doi:10.6028/NIST.FIPS.186-5. S2CID 256480883. Retrieved 2023-03-04. <a href="https://csrc.nist.gov/publications/detail/fips/186/5/final" target="_blank">https://csrc.nist.gov/publications/detail/fips/186/5/final</a> <a href="#fnref:27" class="footnote-back-ref">↩</a></li>
<li id="fn:28">Chalkias, Konstantinos; Garillot, Francois; Nikolaenko, Valeria (2020-10-01). Taming the many EdDSAs. Security Standardisation Research Conference (SSR 2020). Retrieved 2021-02-15. <a href="https://eprint.iacr.org/2020/1244" target="_blank">https://eprint.iacr.org/2020/1244</a> <a href="#fnref:28" class="footnote-back-ref">↩</a></li>
<li id="fn:29">Brendel, Jacqueline; Cremers, Cas; Jackson, Dennis; Zhao, Mang (2020-07-03). The provable security of ed25519: Theory and practice. IEEE Symposium on Security and Privacy (S&P 2021). Retrieved 2021-02-15. <a href="https://eprint.iacr.org/2020/823" target="_blank">https://eprint.iacr.org/2020/823</a> <a href="#fnref:29" class="footnote-back-ref">↩</a></li>
<li id="fn:30">"ed25519-speccheck". GitHub. Retrieved 2021-02-15. <a href="https://github.com/novifinancial/ed25519-speccheck" target="_blank">https://github.com/novifinancial/ed25519-speccheck</a> <a href="#fnref:30" class="footnote-back-ref">↩</a></li>
<li id="fn:31">"Changes since OpenSSH 6.4". 2014-01-03. Retrieved 2016-10-07. <a href="http://www.openssh.com/txt/release-6.5" target="_blank">http://www.openssh.com/txt/release-6.5</a> <a href="#fnref:31" class="footnote-back-ref">↩</a></li>
<li id="fn:32">"What's new in GnuPG 2.1". 2016-07-14. Retrieved 2016-10-07. <a href="https://gnupg.org/faq/whats-new-in-2.1.html" target="_blank">https://gnupg.org/faq/whats-new-in-2.1.html</a> <a href="#fnref:32" class="footnote-back-ref">↩</a></li>
<li id="fn:33">"Things that use Ed25519". 2016-10-06. Retrieved 2016-10-07. <a href="https://ianix.com/pub/ed25519-deployment.html" target="_blank">https://ianix.com/pub/ed25519-deployment.html</a> <a href="#fnref:33" class="footnote-back-ref">↩</a></li>
<li id="fn:34">Harris, B.; Velvindron, L. (February 2020). Ed25519 and Ed448 Public Key Algorithms for the Secure Shell (SSH) Protocol. IETF. doi:10.17487/RFC8709. ISSN 2070-1721. RFC 8709. Retrieved 2022-07-11. <a href="https://datatracker.ietf.org/doc/html/rfc8709" target="_blank">https://datatracker.ietf.org/doc/html/rfc8709</a> <a href="#fnref:34" class="footnote-back-ref">↩</a></li>
<li id="fn:35">Moody, Dustin (2023-02-03). FIPS 186-5: Digital Signature Standard (DSS). NIST. doi:10.6028/NIST.FIPS.186-5. S2CID 256480883. Retrieved 2023-03-04. <a href="https://csrc.nist.gov/publications/detail/fips/186/5/final" target="_blank">https://csrc.nist.gov/publications/detail/fips/186/5/final</a> <a href="#fnref:35" class="footnote-back-ref">↩</a></li>
<li id="fn:36">"System security for watchOS". Retrieved 2021-06-07. <a href="https://support.apple.com/guide/security/system-security-for-watchos-secc7d85209d/" target="_blank">https://support.apple.com/guide/security/system-security-for-watchos-secc7d85209d/</a> <a href="#fnref:36" class="footnote-back-ref">↩</a></li>
<li id="fn:37">Matt Johnston (2013-11-14). "DROPBEAR_2013.61test". Archived from the original on 2019-08-05. Retrieved 2019-08-05. <a href="https://web.archive.org/web/20190805012812/https://secure.ucc.asn.au/hg/dropbear/rev/DROPBEAR_2013.61test" target="_blank">https://web.archive.org/web/20190805012812/https://secure.ucc.asn.au/hg/dropbear/rev/DROPBEAR_2013.61test</a> <a href="#fnref:37" class="footnote-back-ref">↩</a></li>
<li id="fn:38">"Heuristic Algorithms and Distributed Computing" (PDF). Èvrističeskie Algoritmy I Raspredelennye Vyčisleniâ (in Russian): 55–56. 2015. ISSN 2311-8563. Archived from the original (PDF) on 2016-10-20. Retrieved 2016-10-07. <a href="https://web.archive.org/web/20161020120014/http://algorithms.samsu.ru/-tom2-nom4.pdf" target="_blank">https://web.archive.org/web/20161020120014/http://algorithms.samsu.ru/-tom2-nom4.pdf</a> <a href="#fnref:38" class="footnote-back-ref">↩</a></li>
<li id="fn:39">Frank Denis. "Minisign: A dead simple tool to sign files and verify signatures". Retrieved 2016-10-07. <a href="https://jedisct1.github.io/minisign" target="_blank">https://jedisct1.github.io/minisign</a> <a href="#fnref:39" class="footnote-back-ref">↩</a></li>
<li id="fn:40">minisign-misc on GitHub <a href="https://github.com/JayBrown/minisign-misc" target="_blank">https://github.com/JayBrown/minisign-misc</a> <a href="#fnref:40" class="footnote-back-ref">↩</a></li>
<li id="fn:41">Frank Denis (2016-06-29). "libsodium/ChangeLog". GitHub. Retrieved 2016-10-07. <a href="https://github.com/jedisct1/libsodium/blob/a162c09b69075c467dfa985cd605a80955512c48/ChangeLog" target="_blank">https://github.com/jedisct1/libsodium/blob/a162c09b69075c467dfa985cd605a80955512c48/ChangeLog</a> <a href="#fnref:41" class="footnote-back-ref">↩</a></li>
<li id="fn:42">"OpenSSL CHANGES". July 31, 2019. Archived from the original on May 18, 2018. Retrieved August 5, 2019. <a href="https://web.archive.org/web/20180518200747/https://www.openssl.org/news/cl111.txt" target="_blank">https://web.archive.org/web/20180518200747/https://www.openssl.org/news/cl111.txt</a> <a href="#fnref:42" class="footnote-back-ref">↩</a></li>
<li id="fn:43">"python/ed25519.py: the main subroutines". 2011-07-06. Retrieved 2016-10-07. <a href="https://ed25519.cr.yp.to/python/ed25519.py" target="_blank">https://ed25519.cr.yp.to/python/ed25519.py</a> <a href="#fnref:43" class="footnote-back-ref">↩</a></li>
<li id="fn:44">"Software: Alternate implementations". 2015-06-11. Retrieved 2016-10-07. <a href="https://ed25519.cr.yp.to/software.html" target="_blank">https://ed25519.cr.yp.to/software.html</a> <a href="#fnref:44" class="footnote-back-ref">↩</a></li>
<li id="fn:45">"eBACS: ECRYPT Benchmarking of Cryptographic Systems: SUPERCOP". 2016-09-10. Retrieved 2016-10-07. <a href="https://bench.cr.yp.to/supercop.html" target="_blank">https://bench.cr.yp.to/supercop.html</a> <a href="#fnref:45" class="footnote-back-ref">↩</a></li>
<li id="fn:46">"Virgil Security Crypto Library for C: Library: Foundation". GitHub. Retrieved 2019-08-04. <a href="https://github.com/VirgilSecurity/virgil-crypto-c#library-foundation" target="_blank">https://github.com/VirgilSecurity/virgil-crypto-c#library-foundation</a> <a href="#fnref:46" class="footnote-back-ref">↩</a></li>
<li id="fn:47">"wolfSSL Embedded SSL Library (formerly CyaSSL)". Retrieved 2016-10-07. <a href="https://www.wolfssl.com/wolfSSL/Products-wolfssl.html" target="_blank">https://www.wolfssl.com/wolfSSL/Products-wolfssl.html</a> <a href="#fnref:47" class="footnote-back-ref">↩</a></li>
<li id="fn:48">Moody, Dustin (2023-02-03). FIPS 186-5: Digital Signature Standard (DSS). NIST. doi:10.6028/NIST.FIPS.186-5. S2CID 256480883. Retrieved 2023-03-04. <a href="https://csrc.nist.gov/publications/detail/fips/186/5/final" target="_blank">https://csrc.nist.gov/publications/detail/fips/186/5/final</a> <a href="#fnref:48" class="footnote-back-ref">↩</a></li>
</ol>

EdDSA open-in-new

EdDSA