{"id":13456534,"url":"https://github.com/paulmillr/noble-ed25519","last_synced_at":"2025-05-14T09:06:51.136Z","repository":{"id":37432599,"uuid":"192994446","full_name":"paulmillr/noble-ed25519","owner":"paulmillr","description":"Fastest 4KB JS implementation of ed25519 signatures","archived":false,"fork":false,"pushed_at":"2025-05-06T21:29:40.000Z","size":1820,"stargazers_count":452,"open_issues_count":1,"forks_count":54,"subscribers_count":10,"default_branch":"main","last_synced_at":"2025-05-14T09:06:17.271Z","etag":null,"topics":["cryptography","curve","curve25519","ed25519","eddsa","elliptic","fips186","noble","rfc8032","signature","x25519","zip215"],"latest_commit_sha":null,"homepage":"https://paulmillr.com/noble","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/paulmillr.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/funding.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":"audit/2022-02-14-cure53-audit-report.pdf","citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null},"funding":{"github":"paulmillr"}},"created_at":"2019-06-20T22:26:00.000Z","updated_at":"2025-05-05T01:34:40.000Z","dependencies_parsed_at":"2024-02-08T17:29:01.101Z","dependency_job_id":"3db81969-c64e-4c43-bf68-641d4f33f346","html_url":"https://github.com/paulmillr/noble-ed25519","commit_stats":{"total_commits":455,"total_committers":15,"mean_commits":"30.333333333333332","dds":0.04395604395604391,"last_synced_commit":"3506e408deba6adebd8618d1fd90a749f0ba4fdf"},"previous_names":[],"tags_count":53,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paulmillr%2Fnoble-ed25519","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paulmillr%2Fnoble-ed25519/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paulmillr%2Fnoble-ed25519/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paulmillr%2Fnoble-ed25519/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/paulmillr","download_url":"https://codeload.github.com/paulmillr/noble-ed25519/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254110374,"owners_count":22016391,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cryptography","curve","curve25519","ed25519","eddsa","elliptic","fips186","noble","rfc8032","signature","x25519","zip215"],"created_at":"2024-07-31T08:01:23.650Z","updated_at":"2025-05-14T09:06:51.107Z","avatar_url":"https://github.com/paulmillr.png","language":"JavaScript","funding_links":["https://github.com/sponsors/paulmillr"],"categories":["TypeScript","JavaScript","cryptography"],"sub_categories":[],"readme":"# noble-ed25519\n\nFastest 4KB JS implementation of ed25519 signatures.\n\n- ✍️ [EDDSA](https://en.wikipedia.org/wiki/EdDSA) signatures compliant with [RFC8032](https://tools.ietf.org/html/rfc8032),\n  FIPS 186-5\n- 🪢 Consensus-friendly, compliant with [ZIP215](https://zips.z.cash/zip-0215)\n- 🔖 SUF-CMA (strong unforgeability under chosen message attacks) and SBS (non-repudiation / exclusive ownership)\n- 🪶 4KB gzipped, 400 lines of pure ESM, bundler-less code\n\nThe module is a sister project of [noble-curves](https://github.com/paulmillr/noble-curves),\nfocusing on smaller attack surface \u0026 better auditability.\nCurves are drop-in replacement and have more features: Common.js, ristretto255, X25519, curve25519, ed25519ph. To upgrade from v1 to v2, see [Upgrading](#upgrading).\n\n### This library belongs to _noble_ cryptography\n\n\u003e **noble-cryptography** — high-security, easily auditable set of contained cryptographic libraries and tools.\n\n- Zero or minimal dependencies\n- Highly readable TypeScript / JS code\n- PGP-signed releases and transparent NPM builds with provenance\n- Check out [homepage](https://paulmillr.com/noble/) \u0026 all libraries:\n  [ciphers](https://github.com/paulmillr/noble-ciphers),\n  [curves](https://github.com/paulmillr/noble-curves),\n  [hashes](https://github.com/paulmillr/noble-hashes),\n  [post-quantum](https://github.com/paulmillr/noble-post-quantum),\n  4kb [secp256k1](https://github.com/paulmillr/noble-secp256k1) /\n  [ed25519](https://github.com/paulmillr/noble-ed25519)\n\n## Usage\n\n\u003e `npm install @noble/ed25519`\n\n\u003e `deno add jsr:@noble/ed25519`\n\n\u003e `deno doc jsr:@noble/ed25519` # command-line documentation\n\nWe support all major platforms and runtimes. For node.js \u003c= 18 and React Native, additional polyfills are needed: see below.\n\n```js\nimport * as ed from '@noble/ed25519';\n(async () =\u003e {\n  // Uint8Arrays or hex strings are accepted:\n  // Uint8Array.from([0xde, 0xad, 0xbe, 0xef]) is equal to 'deadbeef'\n  const privKey = ed.utils.randomPrivateKey();\n  const message = Uint8Array.from([0xab, 0xbc, 0xcd, 0xde]);\n  const pubKey = await ed.getPublicKeyAsync(privKey); // Sync methods below\n  const signature = await ed.signAsync(message, privKey);\n  const isValid = await ed.verifyAsync(signature, message, pubKey);\n})();\n```\n\n### Enabling synchronous methods\n\nOnly async methods are available by default, to keep the library dependency-free.\nTo enable sync methods:\n\n```ts\nimport { sha512 } from '@noble/hashes/sha512';\ned.etc.sha512Sync = (...m) =\u003e sha512(ed.etc.concatBytes(...m));\n// Sync methods can be used now:\n// ed.getPublicKey(privKey);\n// ed.sign(msg, privKey);\n// ed.verify(signature, msg, pubKey);\n```\n\n### React Native: polyfill getRandomValues and sha512\n\n```ts\nimport 'react-native-get-random-values';\nimport { sha512 } from '@noble/hashes/sha512';\ned.etc.sha512Sync = (...m) =\u003e sha512(ed.etc.concatBytes(...m));\ned.etc.sha512Async = (...m) =\u003e Promise.resolve(ed.etc.sha512Sync(...m));\n```\n\n### nodejs v18 and older: polyfill webcrypto\n\n```ts\nimport { webcrypto } from 'node:crypto';\n// @ts-ignore\nif (!globalThis.crypto) globalThis.crypto = webcrypto;\n```\n\n## API\n\nThere are 3 main methods:\n\n- `getPublicKey(privateKey)` and `getPublicKeyAsync(privateKey)`\n- `sign(message, privateKey)` and `signAsync(message, privateKey)`\n- `verify(signature, message, publicKey)` and `verifyAsync(signature, message, publicKey)`\n\nFunctions generally accept Uint8Array.\nThere are optional utilities which convert hex strings, utf8 strings or bigints to u8a.\n\n### getPublicKey\n\n```typescript\nimport * as ed from '@noble/ed25519';\n(async () =\u003e {\n  const privKeyA = ed.utils.hexToBytes(\n    '9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60'\n  );\n  const pubKeyA = ed.getPublicKey(privKeyA);\n\n  const privKeyB = ed.utils.randomPrivateKey();\n  const pubKeyB = await ed.getPublicKeyAsync(privKeyB);\n  const privKey64Byte = ed.etc.concatBytes(privKeyB, pubKeyB);\n  const pubKeyPoint = ed.ExtendedPoint.fromHex(pubKeyB);\n  const pubKeyExt = ed.utils.getExtendedPublicKey(privKeyB);\n})();\n```\n\nGenerates 32-byte public key from 32-byte private key.\n\n- Some libraries have 64-byte private keys - those are just priv+pub concatenated\n- Use `ExtendedPoint.fromHex(publicKey)` if you want to convert hex / bytes into Point.\n  It will use decompression algorithm 5.1.3 of RFC 8032.\n- Use `utils.getExtendedPublicKey` if you need full SHA512 hash of seed\n\n### sign\n\n```ts\nimport * as ed from '@noble/ed25519';\n(async () =\u003e {\n  const privKey = ed.utils.hexToBytes(\n    '9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60'\n  );\n  const message = Uint8Array.from([0xab, 0xbc, 0xcd, 0xde]);\n  const signature = ed.sign(message, privKey);\n\n  const messageB = new TextEncoder().encode('hello noble');\n  const signatureB = await ed.signAsync(messageB, privKey);\n})();\n```\n\nGenerates deterministic EdDSA signature.\n\nAssumes unhashed `message`: it would be hashed by ed25519 internally.\nFor prehashed ed25519ph, switch to noble-curves.\n\n### verify\n\n```ts\nimport * as ed from '@noble/ed25519';\n(async () =\u003e {\n  const privKey = ed.utils.randomPrivateKey();\n  const message = Uint8Array.from([0xab, 0xbc, 0xcd, 0xde]);\n  const pubKey = await ed.getPublicKeyAsync(privKey);\n  const signature = await ed.signAsync(message, privKey);\n\n  const isValidA = ed.verify(signature, message, pubKey);\n\n  const isValidB = await ed.verifyAsync(signature, message, pubKey);\n  const isValidC = ed.verify(signature, message, pubKey, { zip215: false });\n})();\n```\n\nVerifies EdDSA signature. Has SUF-CMA (strong unforgeability under chosen message attacks).\nBy default, follows ZIP215 [^1] and can be used in consensus-critical apps [^2].\n`zip215: false` option switches verification criteria to strict\nRFC8032 / FIPS 186-5 and provides non-repudiation with SBS (Strongly Binding Signatures) [^3].\n\n### utils\n\nA bunch of useful **utilities** are also exposed:\n\n```typescript\nconst etc: {\n  bytesToHex: (b: Bytes) =\u003e string;\n  hexToBytes: (hex: string) =\u003e Bytes;\n  concatBytes: (...arrs: Bytes[]) =\u003e Uint8Array;\n  mod: (a: bigint, b?: bigint) =\u003e bigint;\n  invert: (num: bigint, md?: bigint) =\u003e bigint;\n  randomBytes: (len: number) =\u003e Bytes;\n  sha512Async: (...messages: Bytes[]) =\u003e Promise\u003cBytes\u003e;\n  sha512Sync: Sha512FnSync;\n};\nconst utils: {\n  getExtendedPublicKeyAsync: (priv: Hex) =\u003e Promise\u003cExtK\u003e;\n  getExtendedPublicKey: (priv: Hex) =\u003e ExtK;\n  precompute(p: Point, w?: number): Point;\n  randomPrivateKey: () =\u003e Bytes; // Uses CSPRNG https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues\n};\n\nclass ExtendedPoint {\n  // Elliptic curve point in Extended (x, y, z, t) coordinates.\n  constructor(ex: bigint, ey: bigint, ez: bigint, et: bigint);\n  static readonly BASE: Point;\n  static readonly ZERO: Point;\n  static fromAffine(point: AffinePoint): ExtendedPoint;\n  static fromHex(hash: string);\n  get x(): bigint;\n  get y(): bigint;\n  // Note: It does not check whether the `other` point is valid point on curve.\n  add(other: ExtendedPoint): ExtendedPoint;\n  equals(other: ExtendedPoint): boolean;\n  isTorsionFree(): boolean; // Multiplies the point by curve order\n  multiply(scalar: bigint): ExtendedPoint;\n  subtract(other: ExtendedPoint): ExtendedPoint;\n  toAffine(): Point;\n  toRawBytes(): Uint8Array;\n  toHex(): string; // Compact representation of a Point\n}\n// Curve params\ned25519.CURVE.p; // 2 ** 255 - 19\ned25519.CURVE.n; // 2 ** 252 + 27742317777372353535851937790883648493\ned25519.ExtendedPoint.BASE; // new ed25519.Point(Gx, Gy) where\n// Gx=15112221349535400772501151409588531511454012693041857206046113283949847762202n\n// Gy=46316835694926478169428394003475163141307993866256225615783033603165251855960n;\n```\n\n## Security\n\nThe module is production-ready.\n\nWe cross-test against sister project [noble-curves](https://github.com/paulmillr/noble-curves), which was audited and provides improved security.\n\n- The current version has not been independently audited. It is a rewrite of v1, which has been audited by cure53 in Feb 2022:\n  [PDF](https://cure53.de/pentest-report_ed25519.pdf).\n- It's being fuzzed [in a separate repository](https://github.com/paulmillr/fuzzing)\n\nIf you see anything unusual: investigate and report.\n\n### Constant-timeness\n\nWe're targetting algorithmic constant time. _JIT-compiler_ and _Garbage Collector_ make \"constant time\"\nextremely hard to achieve [timing attack](https://en.wikipedia.org/wiki/Timing_attack) resistance\nin a scripting language. Which means _any other JS library can't have\nconstant-timeness_. Even statically typed Rust, a language without GC,\n[makes it harder to achieve constant-time](https://www.chosenplaintext.ca/open-source/rust-timing-shield/security)\nfor some cases. If your goal is absolute security, don't use any JS lib — including bindings to native ones.\nUse low-level libraries \u0026 languages.\n\n### Supply chain security\n\n- **Commits** are signed with PGP keys, to prevent forgery. Make sure to verify commit signatures\n- **Releases** are transparent and built on GitHub CI. Make sure to verify [provenance](https://docs.npmjs.com/generating-provenance-statements) logs\n  - Use GitHub CLI to verify single-file builds:\n    `gh attestation verify --owner paulmillr noble-ed25519.js`\n- **Rare releasing** is followed to ensure less re-audit need for end-users\n- **Dependencies** are minimized and locked-down: any dependency could get hacked and users will be downloading malware with every install.\n  - We make sure to use as few dependencies as possible\n  - Automatic dep updates are prevented by locking-down version ranges; diffs are checked with `npm-diff`\n- **Dev Dependencies** are disabled for end-users; they are only used to develop / build the source code\n\nFor this package, there are 0 dependencies; and a few dev dependencies:\n\n- [noble-hashes](https://github.com/paulmillr/noble-hashes) provides cryptographic hashing functionality\n- micro-bmark, micro-should and jsbt are used for benchmarking / testing / build tooling and developed by the same author\n- prettier, fast-check and typescript are used for code quality / test generation / ts compilation. It's hard to audit their source code thoroughly and fully because of their size\n\n### Randomness\n\nWe're deferring to built-in\n[crypto.getRandomValues](https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues)\nwhich is considered cryptographically secure (CSPRNG).\n\nIn the past, browsers had bugs that made it weak: it may happen again.\nImplementing a userspace CSPRNG to get resilient to the weakness\nis even worse: there is no reliable userspace source of quality entropy.\n\n### Quantum computers\n\nCryptographically relevant quantum computer, if built, will allow to\nbreak elliptic curve cryptography (both ECDSA / EdDSA \u0026 ECDH) using Shor's algorithm.\n\nConsider switching to newer / hybrid algorithms, such as SPHINCS+. They are available in\n[noble-post-quantum](https://github.com/paulmillr/noble-post-quantum).\n\nNIST prohibits classical cryptography (RSA, DSA, ECDSA, ECDH) [after 2035](https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8547.ipd.pdf). Australian ASD prohibits it [after 2030](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography).\n\n## Speed\n\nBenchmarks done with Apple M2 on macOS 13 with Node.js 20.\n\n    getPublicKey(utils.randomPrivateKey()) x 9,173 ops/sec @ 109μs/op\n    sign x 4,567 ops/sec @ 218μs/op\n    verify x 994 ops/sec @ 1ms/op\n    Point.fromHex decompression x 16,164 ops/sec @ 61μs/op\n\nCompare to alternative implementations:\n\n    tweetnacl@1.0.3 getPublicKey x 1,808 ops/sec @ 552μs/op ± 1.64%\n    tweetnacl@1.0.3 sign x 651 ops/sec @ 1ms/op\n    ristretto255@0.1.2 getPublicKey x 640 ops/sec @ 1ms/op ± 1.59%\n    sodium-native#sign x 83,654 ops/sec @ 11μs/op\n\n## Upgrading\n\nnoble-ed25519 v2 features improved security and smaller attack surface.\nThe goal of v2 is to provide minimum possible JS library which is safe and fast.\n\nThat means the library was reduced 4x, to just over 300 lines. In order to\nachieve the goal, **some features were moved** to\n[noble-curves](https://github.com/paulmillr/noble-curves), which is\neven safer and faster drop-in replacement library with same API.\nSwitch to curves if you intend to keep using these features:\n\n- x25519 / curve25519 / getSharedSecret\n- ristretto255 / RistrettoPoint\n- Using `utils.precompute()` for non-base point\n- Support for environments which don't support bigint literals\n- Common.js support\n- Support for node.js 18 and older without [shim](#usage)\n\nOther changes for upgrading from @noble/ed25519 1.7 to 2.0:\n\n- Methods are now sync by default; use `getPublicKeyAsync`, `signAsync`, `verifyAsync` for async versions\n- `bigint` is no longer allowed in `getPublicKey`, `sign`, `verify`. Reason: ed25519 is LE, can lead to bugs\n- `Point` (2d xy) has been changed to `ExtendedPoint` (xyzt)\n- `Signature` was removed: just use raw bytes or hex now\n- `utils` were split into `utils` (same api as in noble-curves) and\n  `etc` (`sha512Sync` and others)\n\n## Contributing \u0026 testing\n\n- `npm install \u0026\u0026 npm run build \u0026\u0026 npm test` will build the code and run tests.\n- `npm run bench` will run benchmarks, which may need their deps first (`npm run bench:install`)\n- `npm run loc` will count total output size, important to be less than 4KB\n\nCheck out [github.com/paulmillr/guidelines](https://github.com/paulmillr/guidelines)\nfor general coding practices and rules.\n\nSee [paulmillr.com/noble](https://paulmillr.com/noble/)\nfor useful resources, articles, documentation and demos\nrelated to the library.\n\n## License\n\nMIT (c) 2019 Paul Miller [(https://paulmillr.com)](https://paulmillr.com), see LICENSE file.\n\n[^1]: https://zips.z.cash/zip-0215\n\n[^2]: https://hdevalence.ca/blog/2020-10-04-its-25519am\n\n[^3]: https://eprint.iacr.org/2020/1244\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpaulmillr%2Fnoble-ed25519","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpaulmillr%2Fnoble-ed25519","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpaulmillr%2Fnoble-ed25519/lists"}