Ed25519 is the common EdDSA combination built on the Edwards25519 twisted Edwards curve. It provides 128-bit security and uses deterministic signing, avoiding a fresh random nonce for every message. section 7.3.4
Ed25519 separates secret-key derivation from signing:
- Derive an actual signing key and a nonce key from the secret key. section 7.3.4
- Hash the nonce key together with the message to deterministically obtain the nonce. section 7.3.4
- Compute the commitment from the nonce and base point, then hash the commitment, public key, and message into a challenge. section 7.3.4
- Combine the nonce, challenge, and signing key to produce the signature pair (R, S). section 7.3.4
A storage detail that causes confusion
A library may store either the original 32-byte secret key or the two derived keys in a 64-byte representation. The format depends on the implementation. section 7.3.4
Figure 7.11 EdDSA key generation produces a secret key that is then used to derive two other keys. The first derived key is the actual signing key and can thus be used to derive the public key; the other derived key is the nonce key, used to deterministically derive the nonce during signing operations. EdDSA signatures are then like Schnorr signatures with the exception that (1) the nonce is generated deterministically from the nonce key and the message, and (2) the public key of the signer is included as part of the challenge.
Follow the key-generation and signing flow from the secret key through the signing key, nonce key, deterministic nonce, and challenge. section 7.3.4
