RFC 8709

Ed25519 and Ed448 Public Key Algorithms for the Secure Shell (SSH) Protocol

📅 published February 2020, from ietf

RFC 8709: Ed25519 and Ed448 Public Key Algorithms for the Secure Shell (SSH) Protocol ✨

okay bestie, let's get into this one 💅 It's an IETF Standards Track doc (ISSN 2070-1721) from February 2020, and it updates RFC 4253 🦋 The title block doesn't list anything it obsoletes. The authors are Ben Harris and Loganaden Velvindron (cyberstorm.mu), and the whole thing is published by the Internet Engineering Task Force 🌸

Here's the title block in one place, for reference:

Internet Engineering Task Force (IETF)
Request for Comments: 8709
Updates: 4253
Category: Standards Track
ISSN: 2070-1721
February 2020
Authors: B. Harris and L. Velvindron (cyberstorm.mu)

Abstract 🎀

This doc explains how the Ed25519 and Ed448 digital signature algorithms get used in the Secure Shell (SSH) protocol. So it updates RFC 4253 too 💜

Status of This Memo 🌈

This is an Internet Standards Track document, so it's an official spec and not just a vibe. It's a product of the IETF and represents the consensus of the IETF community. It went through public review and got the okay from the Internet Engineering Steering Group (IESG) 🫶 For more on what Internet Standards are, check Section 2 of RFC 7841.

For the latest on this doc, any errata, and how to send feedback, go to https://www.rfc-editor.org/info/rfc8709 ✨

Copyright Notice 🔥

This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they stand on the publication date. Read those carefully, because they spell out your rights and restrictions. Any Code Components pulled out of this doc must include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, per the Simplified BSD License 💅

Table of Contents 🧚

1.  Introduction
2.  Conventions Used in This Document
  2.1.  Requirements Language
3.  Public Key Algorithm
4.  Public Key Format
5.  Signature Algorithm
6.  Signature Format
7.  Verification Algorithm
8.  SSHFP DNS Resource Records
9.  IANA Considerations
10. Security Considerations
11. References
  11.1.  Normative References
  11.2.  Informative References
Acknowledgements
Authors' Addresses

1. Introduction 🦋

okay so, SSH [RFC4251] is a secure remote-login protocol, and it's giving extensibility 🌸 It supports a whole bunch of public key algorithms for identifying servers and users to each other. Ed25519 [RFC8032] is a digital signature system. OpenSSH 6.5 [OpenSSH-6.5] was the first to support Ed25519 for server and user authentication, and then other SSH implementations followed its lead ✨

This doc describes the method that OpenSSH and others implemented, and it formalizes the name "ssh-ed25519". It also describes Ed448 and formalizes the name "ssh-ed448" 💜

2. Conventions Used in This Document 🎀

The key and signature format descriptions use the notation from [RFC4251], Section 3, plus the string data type from [RFC4251], Section 5 🫶

2.1. Requirements Language 💖

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be read as described in BCP 14 [RFC2119] [RFC8174], but only when they show up in all capitals, exactly like this 🔥

3. Public Key Algorithm 🌈

This doc describes a public key algorithm for SSH, as per [RFC4253], Section 6.6 ✨ The algorithm's name is "ssh-ed25519", and it only does signing, not encryption.

It also describes a second public key algorithm, named "ssh-ed448", which is also signing-only 🦋

Standard SSH implementations "SHOULD" implement these signature algorithms 💅

Wait, let me make the keyword stand out: the original says "Standard implementations of SSH SHOULD implement these signature algorithms", so that's the one normative word in this section, and it keeps its force 💜

4. Public Key Format 🧚

The "ssh-ed25519" key format is encoded like this:

string  "ssh-ed25519"

string  key

Here, key is the 32-octet public key from [RFC8032], Section 5.1.5 🌸

The "ssh-ed448" key format is encoded like this:

string  "ssh-ed448"

string  key

Here, key is the 57-octet public key from [RFC8032], Section 5.2.5 ✨

5. Signature Algorithm 💖

Signatures are made using the procedure in Sections 5.1.6 and 5.2.6 of [RFC8032] 🔥

6. Signature Format 🎀

The "ssh-ed25519" key format is encoded like this:

string  "ssh-ed25519"

string  signature

Here, signature is the 64-octet signature produced under [RFC8032], Section 5.1.6 🦋

The "ssh-ed448" key format is encoded like this:

string  "ssh-ed448"

string  signature

Here, signature is the 114-octet signature produced under [RFC8032], Section 5.2.6 💜

7. Verification Algorithm 🌈

Ed25519 signatures get verified with the procedure in [RFC8032], Section 5.1.7 ✨

Ed448 signatures get verified with the procedure in [RFC8032], Section 5.2.7 💅

8. SSHFP DNS Resource Records 🧚

[RFC4255] covers how the SSHFP DNS resource record gets used and generated 🌸 Generating SSHFP records for "ssh-ed25519" keys is covered in [RFC7479]. This section shows how to generate SSHFP records for "ssh-ed448" keys, and this doc also specifies the matching Ed448 code point in the "SSHFP RR Types for public key algorithms" entry of the "DNS SSHFP Resource Record Parameters" IANA registry [IANA-SSHFP] 🫶

Here's how generating SSHFP records for "ssh-ed448" keys works:

The encoding of Ed448 public keys is described in [ED448]. The short version: an Ed448 public key is a 57-octet value holding a 455-bit y-coordinate of an elliptic curve point, plus a sign bit that tells you the matching x-coordinate 🦋

For example, the SSHFP Resource Record for an Ed448 public key with a SHA-256 fingerprint would be:

example.com. IN SSHFP 6 2 ( a87f1b687ac0e57d2a081a2f2826723
                            34d90ed316d2b818ca9580ea384d924
                            01 )

That 2 means SHA-256 [RFC6594] 💖

9. IANA Considerations 🔥

This doc augments the Public Key Algorithm Names in [RFC4250], Section 4.11.3 🌈

IANA added the following entries to the "Public Key Algorithm Names" section of the "Secure Shell (SSH) Protocol Parameters" registry [IANA-SSH] ✨

+---------------------------+-----------+
| Public Key Algorithm Name | Reference |
+===========================+===========+
| ssh-ed25519               | RFC 8709  |
+---------------------------+-----------+
| ssh-ed448                 | RFC 8709  |
+---------------------------+-----------+

Table 1

IANA also added the following entry to "SSHFP RR Types for public key algorithms" in the "DNS SSHFP Resource Record Parameters" registry [IANA-SSHFP] 🎀

+-------+-------------+-----------+
| Value | Description | Reference |
+=======+=============+===========+
| 6     | Ed448       | RFC 8709  |
+-------+-------------+-----------+

Table 2

10. Security Considerations 🔥😭

Heads up, this section is serious business 💀

The security considerations in [RFC4251], Section 9 apply to all SSH implementations, including the ones that use Ed25519 and Ed448 🫶

The security considerations in [RFC8032], Section 8 and [RFC7479], Section 3 apply to every use of Ed25519 and Ed448, including the ones in SSH 🔥

11. References 🌸

11.1. Normative References 💜

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <https://www.rfc-editor.org/info/rfc2119>.

[RFC4250]  Lehtinen, S. and C. Lonvick, Ed., "The Secure Shell (SSH)
           Protocol Assigned Numbers", RFC 4250,
           DOI 10.17487/RFC4250, January 2006,
           <https://www.rfc-editor.org/info/rfc4250>.

[RFC4251]  Ylonen, T. and C. Lonvick, Ed., "The Secure Shell (SSH)
           Protocol Architecture", RFC 4251, DOI 10.17487/RFC4251,
           January 2006, <https://www.rfc-editor.org/info/rfc4251>.

[RFC4253]  Ylonen, T. and C. Lonvick, Ed., "The Secure Shell (SSH)
           Transport Layer Protocol", RFC 4253, DOI 10.17487/RFC4253,
           January 2006, <https://www.rfc-editor.org/info/rfc4253>.

[RFC4255]  Schlyter, J. and W. Griffin, "Using DNS to Securely
           Publish Secure Shell (SSH) Key Fingerprints", RFC 4255,
           DOI 10.17487/RFC4255, January 2006,
           <https://www.rfc-editor.org/info/rfc4255>.

[RFC6594]  Sury, O., "Use of the SHA-256 Algorithm with RSA, Digital
           Signature Algorithm (DSA), and Elliptic Curve DSA (ECDSA)
           in SSHFP Resource Records", RFC 6594,
           DOI 10.17487/RFC6594, April 2012,
           <https://www.rfc-editor.org/info/rfc6594>.

[RFC8032]  Josefsson, S. and I. Liusvaara, "Edwards-Curve Digital
           Signature Algorithm (EdDSA)", RFC 8032,
           DOI 10.17487/RFC8032, January 2017,
           <https://www.rfc-editor.org/info/rfc8032>.

[RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
           2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
           May 2017, <https://www.rfc-editor.org/info/rfc8174>.

11.2. Informative References ✨

[ED448]    Hamburg, M., "Ed448-Goldilocks, a new elliptic curve",
           January 2015, <https://eprint.iacr.org/2015/625.pdf>.

[IANA-SSH] IANA, "Secure Shell (SSH) Protocol Parameters",
           <https://www.iana.org/assignments/ssh-parameters>.

[IANA-SSHFP]
           IANA, "DNS SSHFP Resource Record Parameters",
           <https://www.iana.org/assignments/dns-sshfp-rr-
           parameters>.

[OpenSSH-6.5]
           Friedl, M., Provos, N., de Raadt, T., Steves, K., Miller,
           D., Tucker, D., McIntyre, J., Rice, T., and B. Lindstrom,
           "OpenSSH 6.5 release notes", January 2014,
           <http://www.openssh.com/txt/release-6.5>.

[RFC7479]  Moonesamy, S., "Using Ed25519 in SSHFP Resource Records",
           RFC 7479, DOI 10.17487/RFC7479, March 2015,
           <https://www.rfc-editor.org/info/rfc7479>.

Acknowledgements 💖

The OpenSSH implementation of Ed25519 in SSH was written by Markus Friedl 🧚 The authors also thank Mark Baushke, Benjamin Kaduk, and Daniel Migault for their comments 🫶

Authors' Addresses 🦋

Ben Harris
2A Eachard Road
Cambridge
CB3 0HY
United Kingdom

Email: bjh21@bjh21.me.uk


Loganaden Velvindron
cyberstorm.mu
88, Avenue De Plevitz
Roches Brunes
Mauritius

Email: logan@cyberstorm.mu

📦 where this page comes from

ietf: rfc8709 2020-02
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms