# Is every bytestring a valid Ed25519 private key?

In other words, is it a bad idea to simply do this?

signingkey = crypto_random_bytes();
verifykey = Ed25519.verifykey_from_signingkey(signingkey);


Are there weak keys that standard libraries protect you from?

There are a few different formats for the standard parts of an Ed25519 private key, which are usually stored as 32-byte or 64-byte strings, so you need to pay attention to the choices made by the system you use it with. Everyone agrees on how to compute an Ed25519 signature given a secret scalar, which can be a uniform random 256-bit integer, and a PRF secret, which is a uniform random 256-bit string, but the scalar and PRF secret are stored or derived differently in different contexts.

In some exotic protocols where you share a secret scalar between Ed25519 and the X25519 Diffie–Hellman function, the secret scalar may need to be clamped for DH security. Some libraries do this automatically, particularly those that use a 32-byte pre-master secret; others do not, particularly those that involve hierarchical key derivation.

For example, in libsodium, crypto_sign_keypair generates a 64-byte secret key consisting of the 32-byte pre-master secret seed and the 32-byte public key, with clamping of the scalar. crypto_sign_keypair_seed derives that same 64-byte secret key from a 32-byte pre-master secret seed.

For the most part, an Ed25519 private key—meaning secret scalar and PRF secret—really is just a uniform random string of either 32 or 64 bytes. But different libraries may have slightly different rules, so pay attention to the rules of the library.

• As I recall libsodium's implementation it's not really a random 64-byte string, rather the "secret key" is a combination of the 32-byte representation of the clamped secret key value along with the 32-byte representation of the public key (the Y coordinate as I recall). Nevertheless, the right way to create a key is either to use crypto_sign_keypair() to generate a new random key or crypto_sign_seed_keypair() to generate based on a 32-byte seed value. The result will be an appropriate clamped value.