Edwards25519 is a twisted Edwards elliptic curve used with EdDSA. The common combination is called Ed25519 and provides approximately 128-bit security. section 7.3.4
Ed25519 signing follows a deliberately repeatable key-and-nonce path:
- Generate a secret key, then derive the actual signing key and a separate nonce key. section 7.3.4
- Derive the public key from the signing key. section 7.3.4
- Hash the nonce key with the message to deterministically produce the per-signature nonce, avoiding fresh randomness for every signature. section 7.3.4
- Expect implementation differences: some libraries store a 32-byte secret key, while others store 64 bytes containing derived keys. section 7.3.4
A useful mental model
Think of EdDSA as Schnorr-like signing with two deliberate twists: the message and nonce key deterministically produce the nonce, and the public key participates in the challenge. section 7.3.4
Figure 7.11 EdDSA key generation produces a secret key that is then used to derive two other keys. The first derived key is the actual signing key and can thus be used to derive the public key; the other derived key is the nonce key, used to deterministically derive the nonce during signing operations. EdDSA signatures are then like Schnorr signatures with the exception that (1) the nonce is generated deterministically from the nonce key and the message, and (2) the public key of the signer is included as part of the challenge.
Follow the key-generation diagram to see how one secret key becomes a signing key, public key, and nonce key before signing. section 7.3.4
