v137 · miscellaneous

Ed25519 in Web Cryptography

This feature adds support for Curve25519 algorithms in the Web Cryptography API, namely the signature algorithm Ed25519

concepts

  1. Ed25519

    Ed25519 signature / key generation in Web Crypto. Modern curve, small keys, fast operations — usable for JWT signing, content signatures, mutual auth.

  2. JWT EdDSA

    End-to-end JWT signing with alg: EdDSA. Generate, sign, verify, tamper. The real-world use case that previously needed shipping tweetnacl.

  3. Signature Verifier & Benchmark

    Paste raw pubkey + signature to verify content you didn’t sign. One-bit tamper button. Live benchmark of generate / sign / verify for Ed25519 vs ECDSA P-256, 100 iterations each.

  4. Keystore roundtrip

    End-to-end: generate, JWK / raw export, AES-KW wrap, IndexedDB persist, reload, unwrap, sign, verify. The pattern any web app that wants Ed25519-backed sessions or assertions needs.

why it shipped

Today web developers are getting around the unavailability of Curve25519 [1] in browser by either including an implementation of its operations in JavaScript or compiling a native one into WebAssembly. Aside from wasting bandwidth shipping algorithms that are already included in browsers that support TLS 1.3, this practice also has security implications, e.g. side-channel attacks as studied by Daniel Genkin et al [2]. [1] RFC 7748, Elliptic Curves for Security [2] Daniel Genkin et al, Drive-By Key-Extraction Cache Attacks from Portable Code.

references