Ed25519
Last updated
Ed25519 is a public-key digital signature scheme based on the Edwards-curve Digital Signature Algorithm using Curve25519. It lets a device hold a private key, sign data with it, and let anyone verify the signature with the matching public key. Ed25519 is widely used because it is fast, produces small keys and signatures, and is designed to avoid common implementation pitfalls.
How it works
A digital signature proves that a message was produced by the holder of a private key and has not been altered. Ed25519 generates a keypair: a private key kept secret on the device and a public key shared freely. Signing a message with the private key produces a compact signature, and anyone with the public key can verify that signature without ever seeing the private key.
Ed25519 uses the Edwards form of Curve25519 and a deterministic signing process, which removes the need for a good random number at signing time, a step that has historically caused catastrophic failures in other schemes. Its keys are 32 bytes and its signatures are 64 bytes, which is small enough to embed in constrained protocols.
Because verification is a fast local computation, two parties can check each other’s signatures with no server and no certificate authority involved.
Why it matters
Ed25519 is fast, compact, and robust, which is why it appears across modern systems, from SSH and TLS to cryptocurrencies and secure messaging. Its small keys and offline-verifiable signatures make it especially well suited to constrained and disconnected environments.
Crucially, verification needs no third party. Two devices can establish that they are talking to the intended party by checking a signature locally, which is the foundation of self-sovereign identity.
How it relates to Offline Protocol
Offline Protocol builds its identity, OfflineID, on Ed25519. Each identity is an Ed25519 keypair generated on the device, and the private key never leaves it. Verifying a peer is a local signature check over BLE or a QR exchange, so devices authenticate each other with no server, certificate authority, or identity provider in the loop.
Those identities also anchor the encrypted sessions the mesh uses, alongside MLS (RFC 9420). See offline identity for the full lifecycle, including rotation and revocation.
Frequently asked questions
What is Ed25519 used for?
Ed25519 is a digital signature scheme used to prove that data came from the holder of a private key and was not altered. It appears in SSH, TLS, secure messaging, and identity systems, and it enables offline, server-free verification.
Why is Ed25519 popular?
It is fast, uses small 32-byte keys and 64-byte signatures, and its deterministic signing avoids a common class of implementation bugs, making it both efficient and hard to misuse.
How does Offline Protocol use Ed25519?
Each OfflineID identity is an Ed25519 keypair generated on the device, with the private key kept local. Peers verify each other with a local signature check over BLE or QR, so authentication needs no server.
