the elliptic-curve version of the older DSA standard - ubiquitous, standardized, and carrying one famous footgun: every signature needs a fresh, secret, unpredictable nonce, and any slip leaks the private key.
The cautionary column: one reused nonce and the private key walks out.
Hand-authored SVG for this glossary, 2026. Incidents per fail0verflow 27C3 (2010) and the 2013 Android SecureRandom advisories; determinism per RFC 8032.
Etymology and backstory
DSA was a 1990s US standard designed partly to route around the Schnorr patent; ECDSA is its elliptic-curve port (ANSI X9.62, FIPS 186). The nonce failure is not theoretical. In 2010 the fail0verflow team extracted Sony's PlayStation 3 signing key because Sony reused one nonce across signatures. In 2013 an Android SecureRandom weakness let attackers drain Bitcoin wallets the same way. RFC 6979 later patched the scheme with derived deterministic nonces - which is the fix Ed25519 had baked in from birth.
Ecosystem
still everywhere - Bitcoin and Ethereum signatures, most WebPKI certificates, smartcards - because standards momentum is real.
In codexproof
not used, and the choice is deliberate interview material. When asked "why Ed25519 over ECDSA," the answer is the nonce story plus speed plus size.