EVP_SIGNATURE-ED25519(7ossl)

📦 version 14.5, in freebsd 14.5

💜 EVP_SIGNATURE-ED25519 — the Ed25519 & Ed448 glow-up (7ossl, OpenSSL, bestie)

okay so this is the OpenSSL manual page for EVP_SIGNATURE-ED25519, EVP_SIGNATURE-ED448, Ed25519 and Ed448 — it's the whole Ed25519 and Ed448 support situation, and honestly it ate. Let's get into it 🫶

✨ NAME ✨

EVP_SIGNATURE-ED25519, EVP_SIGNATURE-ED448, Ed25519, Ed448 — that's the full squad, and together they're the EVP_PKEY Ed25519 and Ed448 support 💅

🌸 DESCRIPTION 🌸

So the Ed25519 and Ed448 EVP_PKEY implementation is out here supporting:

  • key generation 🔑
  • one-shot digest sign
  • digest verify

...all using PureEdDSA and Ed25519 or Ed448 (see RFC8032). It has associated private and public key formats that are compatible with RFC 8410. iconic behaviour, no notes.

🦋 ED25519 and ED448 Signature Parameters

okay real talk: no additional parameters can be set during one-shot signing or verification. Like, none. Zero. It's giving minimalist.

In particular — and this is the important part — because PureEdDSA is used, a digest must NOT be specified when signing or verifying. not one. don't do it. see EVP_PKEY-X25519(7) for the info related to X25519 and X448 keys, different vibes entirely.

The following signature parameters can be retrieved using EVP_PKEY_CTX_get_params():

  • "algorithm-id" (OSSL_SIGNATURE_PARAM_ALGORITHM_ID) <octet string> — and the details on that are described over in provider-signature(7) 💫

🎀 NOTES 🎀

The PureEdDSA algorithm does not support the streaming mechanism that other signature algorithms use (you know, the EVP_DigestUpdate() situation). The message you want to sign or verify must be passed using the one-shot EVP_DigestSign() and EVP_DigestVerify() functions. one shot, one opportunity, periodt.

when you're calling EVP_DigestSignInit() or EVP_DigestVerifyInit(), the digest type parameter MUST be set to NULL. not optional. mandatory. this is the vibe check and you will fail it if you pass a digest 💀

Applications wishing to sign certificates (or other structures such as CRLs or certificate requests) using Ed25519 or Ed448 can either use X509_sign() or X509_sign_ctx() in the usual way. no drama, standard procedure 💖

Ed25519 or Ed448 private keys can be set directly using EVP_PKEY_new_raw_private_key(3) or loaded from a PKCS#8 private key file using PEM_read_bio_PrivateKey(3) (or a similar function). Completely new keys can also be generated — there's an example below, keep scrolling bestie 👀. Setting a private key also sets the associated public key. two for one, we love efficiency.

Ed25519 or Ed448 public keys can be set directly using EVP_PKEY_new_raw_public_key(3) or loaded from a SubjectPublicKeyInfo structure in a PEM file using PEM_read_bio_PUBKEY(3) (or a similar function). also slay.

Ed25519 and Ed448 can be tested with the openssl-speed(1) application since version 1.1.1. valid algorithm names are ed25519, ed448 and eddsa. and like — if you specify eddsa, then both Ed25519 and Ed448 are benchmarked. both of them. together. besties 🫶

🔥 EXAMPLES 🔥

okay this is the fun part. to sign a message using an ED25519 or ED448 key, it looks like this:

void do_sign(EVP_PKEY *ed_key, unsigned char *msg, size_t msg_len)
{
    size_t sig_len;
    unsigned char *sig = NULL;
    EVP_MD_CTX *md_ctx = EVP_MD_CTX_new();

    EVP_DigestSignInit(md_ctx, NULL, NULL, NULL, ed_key);
    /* Calculate the requires size for the signature by passing a NULL buffer */
    EVP_DigestSign(md_ctx, NULL, &sig_len, msg, msg_len);
    sig = OPENSSL_zalloc(sig_len);

    EVP_DigestSign(md_ctx, sig, &sig_len, msg, msg_len);
    ...
    OPENSSL_free(sig);
    EVP_MD_CTX_free(md_ctx);
}

the way that first EVP_DigestSign() call passes a NULL buffer just to calculate the required size for the signature and then you allocate... that's the move. that's the whole strategy. iykyk ✨

🌈 SEE ALSO 🌈

EVP_PKEY-X25519(7) provider-signature(7), EVP_DigestSignInit(3), EVP_DigestVerifyInit(3),

Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, bestie, you're now officially educated on Ed25519 and Ed448 💖 this was 3.0.21, dated 2026-06-09, straight from the EVP_SIGNATURE-ED25519(7ossl) files — go forth and sign one-shot only, mwah 🎀✨🦋

📦 where this page comes from