the modern default signature scheme - Schnorr-style signatures over the twisted Edwards form of Curve25519, giving 32-byte keys, 64-byte signatures, microsecond speeds, and no random-number generator needed at signing time.
Why the boring choice wins: the nonce story in two columns.
Hand-authored SVG for this glossary, 2026. Incidents per fail0verflow 27C3 (2010) and the 2013 Android SecureRandom advisories; determinism per RFC 8032.
Etymology and backstory
Daniel J. Bernstein introduced Curve25519 for key exchange in 2006, choosing every constant for speed and implementation safety. Ed25519 arrived in the 2011 paper "High-speed high-security signatures" by Bernstein, Duif, Lange, Schwabe, and Yang. The name is curve plus prime: the curve works modulo 2 to the 255 minus 19. Standardized as EdDSA in RFC 8032 (2017). Its signature move: the per-signature nonce is derived by hashing the private key with the message - deterministic, so a broken RNG can never leak the key.
Ecosystem
OpenSSH's preferred key type, signify and minisign, Signal, TLS 1.3 certificates, most modern supply-chain signing (Sigstore). The boring, correct choice.
In codexproof
the only signature algorithm in the system. Measured at ~11us per sign inside the ~15us sealing budget; sign.rs holds the implementation, including did_key encoding (line 111) and SignedNode (line 183).