Why Ed25519 Won: Deterministic Signatures and ECDSA's k-Leak Incident History

ECDSA's original sin: roll a die before every signature

ECDSA requires a fresh, absolutely secret, perfectly random ephemeral k for every signature. Sounds harmless. It produced three famous incidents in fifteen years:

• Sony PS3 (2010): firmware signing used a fixed k — anyone could recover Sony's private key from two signatures, unlocking the console with "officially signed" code
• Android Bitcoin wallets (2013): a flawed random generator in a system update produced weak k values; affected wallets' private keys could be recomputed and were drained
• RFC 6979 (2013): the industry invented "deterministic k" — derive it from the private key and message hash, bypassing randomness entirely. A patch on the old algorithm

The essence: ECDSA made "high-quality randomness" an implicit precondition of every single signature, and randomness is historically the most failure-prone input in engineering. One k reuse, one low-entropy draw, and every past signature plus the private key falls together.

Ed25519's answer: randomness is out of the protocol

Daniel J. Bernstein's 2011 design (the EdDSA system over Curve25519) turned the patch into the foundation:

• Signatures are deterministic — the same key and message always produce the same signature; the RNG is never consulted, and the k-leak class of incidents structurally disappears
• The curve is fixed — no parameterizable curve equation, so ECDSA-style invalid-curve attacks have no surface to exist on
• Hard to implement wrong — complete formulas and explicit cofactor handling lower the side-channel bar compared to ECDSA
• Fast and small — 32-byte public keys, 64-byte signatures, verification noticeably faster than ECDSA P-256 (at the same 128-bit security level)

One fact to state plainly: Ed25519 and ECDSA P-256 have the same mathematical security strength. It didn't win by being "harder to break" — it won on engineering properties, by deleting the most error-prone part of the protocol.

Who has already bet on it

• SSH: ssh-keygen -t ed25519 is the first recommendation across distributions and GitHub; RSA keys are legacy assets
• TLS 1.3: X25519 (the same curve family) is half of the default key-exchange groups — it's the classical half of the ML-KEM hybrid handshake
• Signal: builds its Double Ratchet on X25519
• JWT/JOSE: EdDSA is a registered algorithm (compare key-distribution advantages over RS256 in JWT vs. sessions)
• Git signing / minisign / age: the new generation of signing and encryption tools is nearly unanimous

The quantum footnote

"Best classical algorithm" is not "forever" — Ed25519's elliptic-curve foundation sits on Shor's list right next to RSA (see whose data moves first). Its three identities across time: today it's the best signature in the classical world; during migration it's the classical half of hybrid key exchange; at the endgame it gets succeeded by composite ML-DSA schemes. Choosing it was never a wrong bet — it's choosing the best engineering properties of each generation.

Implementer's note

The site's JWT generator currently implements only HS256 — an honest tradeoff: HMAC behaves identically across every browser's WebCrypto, while Ed25519 only landed in mainstream browsers over the last couple of years (with divergent raw-key export behaviors along the way). Which proves the theme of this post: an algorithm's engineering properties (implementation consistency, misuse surface) set the pace of its adoption in products — raw mathematical strength is the easiest box to check. When EdDSA signing enters the tool matrix depends on browser fragmentation converging — the same rhythm as PQC waiting for WebCrypto ML-KEM (see the migration checklist).

Related reading

• ML-KEM, explained
• RSA encryption, explained properly
• Post-quantum migration self-check
• Hash collisions, explained