Ed25519: Signatures, Curve25519 and Quantum Risk

Ed25519 is a digital signature scheme, not encryption. It lets a verifier check that a message was signed by the holder of a private key. It is efficient against known classical attacks when implemented correctly, but it is not a post-quantum signature scheme.

What does Ed25519 do?

RFC 8032 specifies Ed25519 as an instance of Edwards-curve Digital Signature Algorithm, or EdDSA. A signer uses a secret key and a message to produce a signature; the recipient uses the public key to check it. Signing authenticates a message. It does not conceal the message's contents.

For example, a wallet can sign a transaction while a node verifies it without learning the private key. The security requirement is that someone who sees the public key and earlier signatures cannot produce a valid signature for a new, unauthorized transaction.

Ed25519 vs X25519 vs secp256k1

Why is Ed25519 vulnerable to quantum attacks?

Its public-key security depends on the difficulty of recovering a secret scalar from an elliptic-curve public point. Shor's algorithm changes that difficulty on a sufficiently capable quantum computer. Merely storing a private key offline does not remove a mathematical attack against an exposed public key.

A usable attack needs reliable logical operations and enough time to complete the circuit. A vendor's physical-qubit count is not evidence that the device can do this. The published secp256k1 resource estimates illustrate that distinction, but they must not be treated as exact Ed25519 cost estimates.

How does this relate to Monero?

Monero's documentation describes CLSAG, the linkable ring signature construction that replaced MLSAG. Calling the entire transaction scheme “Ed25519” hides important protocol detail. Read the Monero quantum resistance status for 2026 for the distinction between current cryptography and upgrade research.

What should a wallet user verify?

Check the deployed transaction-signing algorithm, not just an encrypted connection or a product label. A post-quantum key exchange does not automatically make a classical transaction signature post-quantum. Review the wallet security checklist, then compare it with the SYNX wallet documentation.