Fastest 5KB JS implementation of ed25519 signatures.
The module is a sister project of noble-curves, focusing on smaller attack surface & better auditability. Curves are drop-in replacement and have more features: ristretto255, x25519 / curve25519, ed25519ph, hash-to-curve, oprf. To upgrade from v1 to v2, see Upgrading.
noble-cryptography — high-security, easily auditable set of contained cryptographic libraries and tools.
npm install @noble/ed25519
deno add jsr:@noble/ed25519
We support all major platforms and runtimes. For node.js <= 18 and React Native, additional polyfills are needed: see below.
import * as ed from '@noble/ed25519';
(async () => {
const { secretKey, publicKey } = await ed.keygenAsync();
// const publicKey = await ed.getPublicKeyAsync(secretKey);
const message = new TextEncoder().encode('hello noble');
const signature = await ed.signAsync(message, secretKey);
const isValid = await ed.verifyAsync(signature, message, publicKey);
})();
Only async methods are available by default, to keep the library dependency-free. To enable sync methods:
import { sha512 } from '@noble/hashes/sha2.js';
ed.hashes.sha512 = sha512;
// Sync methods can be used now:
const { secretKey, publicKey } = ed.keygen();
// const publicKey = ed.getPublicKey(secretKey);
const sig = ed.sign(msg, secretKey);
const isValid = ed.verify(sig, msg, publicKey);
import 'react-native-get-random-values';
import { sha512 } from '@noble/hashes/sha2.js';
ed.hashes.sha512 = sha512;
ed.hashes.sha512Async = (m: Uint8Array) => Promise.resolve(sha512(m));
There are 4 main methods, which accept Uint8Array-s:
keygen() and keygenAsync()getPublicKey(secretKey) and getPublicKeyAsync(secretKey)sign(message, secretKey) and signAsync(message, secretKey)verify(signature, message, publicKey) and verifyAsync(signature, message, publicKey)import * as ed from '@noble/ed25519';
(async () => {
const keys = ed.keygen(); // needs ed.hashes.sha512
const { secretKey, publicKey } = keys
const keysA = await ed.keygenAsync();
})();
import * as ed from '@noble/ed25519';
(async () => {
const pubKey = ed.getPublicKey(secretKeyA); // needs ed.hashes.sha512
const pubKeyA = await ed.getPublicKeyAsync(secretKeyA);
const pubKeyPoint = ed.Point.fromBytes(pubKeyB);
const pubKeyExtended = ed.utils.getExtendedPublicKey(secretKeyA);
})();
Generates 32-byte public key from 32-byte private key.
ExtendedPoint.fromHex(publicKey) if you want to convert hex / bytes into Point.
It will use decompression algorithm 5.1.3 of RFC 8032.utils.getExtendedPublicKey if you need full SHA512 hash of seedimport * as ed from '@noble/ed25519';
(async () => {
const { secretKey, publicKey } = ed.keygen();
const message = new TextEncoder().encode('hello noble');
const signature = ed.sign(message, secretKey);
const signatureA = await ed.signAsync(message, secretKey);
})();
Generates deterministic EdDSA signature. message would be hashed by ed25519 internally.
For prehashed ed25519ph, switch to noble-curves.
import * as ed from '@noble/ed25519';
(async () => {
const { secretKey, publicKey } = ed.keygen();
const message = new TextEncoder().encode('hello noble');
const signature = ed.sign(message, secretKey);
const isValid = ed.verify(signature, message, pubKey);
const isValidFips = ed.verify(signature, message, pubKey, { zip215: false });
const isValidA = await ed.verifyAsync(signature, message, pubKey);
})();
Verifies EdDSA signature. Has SUF-CMA (strong unforgeability under chosen message attacks).
By default, follows ZIP215 1 and can be used in consensus-critical apps 2.
zip215: false option switches verification criteria to strict
RFC8032 / FIPS 186-5 and provides non-repudiation with SBS (Strongly Binding Signatures) 3.
A bunch of useful utilities are also exposed:
import * as ed from '@noble/ed25519';
const { bytesToHex, hexToBytes, concatBytes, mod, invert, randomBytes } = ed.etc;
const { getExtendedPublicKey, getExtendedPublicKeyAsync, randomSecretKey } = ed.utils;
const { Point } = ed;
console.log(Point.CURVE(), Point.BASE);
/*
class Point {
static BASE: Point;
static ZERO: Point;
readonly X: bigint;
readonly Y: bigint;
readonly Z: bigint;
readonly T: bigint;
constructor(X: bigint, Y: bigint, Z: bigint, T: bigint);
static CURVE(): EdwardsOpts;
static fromAffine(p: AffinePoint): Point;
static fromBytes(hex: Bytes, zip215?: boolean): Point;
static fromHex(hex: string, zip215?: boolean): Point;
get x(): bigint;
get y(): bigint;
assertValidity(): this;
equals(other: Point): boolean;
is0(): boolean;
negate(): Point;
double(): Point;
add(other: Point): Point;
subtract(other: Point): Point;
multiply(n: bigint, safe?: boolean): Point;
multiplyUnsafe(scalar: bigint): Point;
toAffine(): AffinePoint;
toBytes(): Bytes;
toHex(): string;
clearCofactor(): Point;
isSmallOrder(): boolean;
isTorsionFree(): boolean;
}
*/
The module is production-ready.
We cross-test against sister project noble-curves, which was audited and provides improved security.
If you see anything unusual: investigate and report.
We're targetting algorithmic constant time. JIT-compiler and Garbage Collector make "constant time" extremely hard to achieve timing attack resistance in a scripting language. Which means any other JS library can't have constant-timeness. Even statically typed Rust, a language without GC, makes it harder to achieve constant-time for some cases. If your goal is absolute security, don't use any JS lib — including bindings to native ones. Use low-level libraries & languages.
npm-diffFor this package, there are 0 dependencies; and a few dev dependencies:
We're deferring to built-in crypto.getRandomValues which is considered cryptographically secure (CSPRNG).
In the past, browsers had bugs that made it weak: it may happen again. Implementing a userspace CSPRNG to get resilient to the weakness is even worse: there is no reliable userspace source of quality entropy.
Cryptographically relevant quantum computer, if built, will allow to break elliptic curve cryptography (both ECDSA / EdDSA & ECDH) using Shor's algorithm.
Consider switching to newer / hybrid algorithms, such as SPHINCS+. They are available in noble-post-quantum.
NIST prohibits classical cryptography (RSA, DSA, ECDSA, ECDH) after 2035. Australian ASD prohibits it after 2030.
npm run bench
Benchmarks measured with Apple M4.
init 11ms
keygen x 11,253 ops/sec @ 88μs/op
sign x 5,891 ops/sec @ 169μs/op
verify x 1,281 ops/sec @ 780μs/op
keygenAsync x 10,205 ops/sec @ 97μs/op
signAsync x 4,985 ops/sec @ 200μs/op
verifyAsync x 1,286 ops/sec @ 777μs/op
Point.fromBytes x 22,811 ops/sec @ 43μs/op
Compare to alternative implementations:
tweetnacl@1.0.3 getPublicKey x 1,808 ops/sec @ 552μs/op ± 1.64%
tweetnacl@1.0.3 sign x 651 ops/sec @ 1ms/op
ristretto255@0.1.2 getPublicKey x 640 ops/sec @ 1ms/op ± 1.59%
sodium-native#sign x 83,654 ops/sec @ 11μs/op
v3 brings the package closer to noble-curves v2.
keygen, keygenAsync methodhashes object:// before
ed.etc.sha512 = sha512;
ed.etc.sha512Async = (m: Uint8Array) => Promise.resolve(sha512(m));
// after
ed.hashes.sha512 = sha512;
ed.hashes.sha512Async = (m: Uint8Array) => Promise.resolve(sha512(m));
v2 features improved security and smaller attack surface. The goal of v2 is to provide minimum possible JS library which is safe and fast.
That means the library was reduced 4x, to just over 300 lines. In order to achieve the goal, some features were moved to noble-curves, which is even safer and faster drop-in replacement library with same API. Switch to curves if you intend to keep using these features:
utils.precompute() for non-base pointOther changes for upgrading from @noble/ed25519 1.7 to 2.0:
getPublicKeyAsync, signAsync, verifyAsync for async versionsbigint is no longer allowed in getPublicKey, sign, verify. Reason: ed25519 is LE, can lead to bugsPoint (2d xy) has been changed to ExtendedPoint (xyzt)Signature was removed: just use raw bytes or hex nowutils were split into utils (same api as in noble-curves) and
etc (sha512Sync and others)npm install && npm run build && npm test will build the code and run tests.npm run bench will run benchmarksnpm run build:release will build single fileSee paulmillr.com/noble for useful resources, articles, documentation and demos related to the library.
The MIT License (MIT)
Copyright (c) 2019 Paul Miller (https://paulmillr.com)
See LICENSE file.