Ed25519 cryptanalysis and backdoor?

Question

I am looking to implement Ed25519 for decentralized identity at scale.

Has Ed25519 has gone through rigorous cryptanalysis?

Could there be a backdoor in the algorithm?

Answer 1

if Ed25519 has gone through rigorous cryptanalysis

It is based on Curve25519 which has gone through extensive cryptanalysis. The Ed25519 signature scheme as well is being heavily reviewed and adoption is rapid. There are already a number of papers on the algorithm itself, as well as a few papers on specific implementations. Every part of the algorithm and design decisions are justified in the paper introducing it.

if there are any possible backdoor in the algorithm?

The algorithm is based on simple* and easy to explain parameters. This is explained here, where various ECC curves are compared and contrasted. Compared to many other common curves, Curve25519 does not use any long, strange, inexplicable parameters like some other curves do. Ed25519, naturally, uses the same curve with the same explainable curve parameters: $y^2 = x^3 + 486662x^2 + x$, modulo $p = 2^{255} - 19$. These parameters are all justified in the relevant paper introducing the curve. Compare this with, say, the NIST curves which all have very strange, long, and unexplained parameters.

Additionally, the algorithm was designed by Daniel J. Bernstein, a cryptographer who is well-known for going to court and fighting against the government when it tried to weaken cryptography. It is not designed by a nameless cryptographer or pushed by a sketchy group.

_{* Simple if you're familiar with elliptic curve mathematics.}

Answer 2

(Ran into this old question when looking for ed25519 information.)

This paper provides formal proofs and the security impact of the differences between the original, IETF, and LibSodium variants:

https://eprint.iacr.org/2020/823