What is Ed25519?

Ed25519 is a digital signature scheme, the Edwards-curve Digital Signature Algorithm on the edwards25519 curve, that lets anyone holding a public key check that a message was signed by the matching private key and has not changed since.

Key facts

Ed25519 is specified in RFC 8032, published in January 2017:

• public keys are 32 bytes, signatures are 64 bytes;
• it targets roughly the 128-bit security level;
• signing is deterministic: the same key and message always give the same signature, and no fresh random number is needed for each signature.

The last point matters in practice. In some older signature schemes, a weak or repeated random value during signing can expose the private key. Ed25519 derives that per-signature value from the key and the message instead, so a poor random number generator at signing time does not leak the key.

What a signature proves, and what it does not

A valid signature proves that the holder of a particular private key signed exactly these bytes. It does not prove who that holder is. To trust a signature you also need to know that the public key belongs to the right person or system, which is what fingerprints and pinned keys are for. A signature also says nothing about freshness: an old signed document is still validly signed, which is why systems add rollback protection.

How Crunu uses it

Crunu relies on Ed25519 signatures wherever a compromised server could otherwise change what people trust:

• Access. The list of who can read an environment is a document signed by an admin.
• Versions. Every version of an environment is signed by the member who saved it.
• Access profiles and invitations. Each version of an access profile is signed; an invitation record is signed by its creator.
• Revocations. Removed people and machines are listed in a document signed with the organization key.
• Share links. The shared content is signed with the link's key, so tampering shows.
• Releases. The agent and the web client are signed; the installer, crunu self-update and the web client check the signature.

The crunu agent checks signatures and certificates on everything the server sends. If a check fails, it refuses the data, logs an alert and exits with code 6. Encryption, which Ed25519 does not provide, is done with X25519 and AES-256-GCM. See how encryption works.

Sources

• RFC 8032: Edwards-Curve Digital Signature Algorithm (EdDSA), checked October 27, 2026.